xmrig | 724f01d279e0341469f26964749155033675f8537622b23266855d572728d2cc

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 09:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
Size

1.6MB
MD5

03578db55de02156f5b6401a096919d0
SHA1

e819563307677279d1038df15f28ac3cd0e309c5
SHA256

724f01d279e0341469f26964749155033675f8537622b23266855d572728d2cc
SHA512

4757541fe507a0fc2fb29da741cfa4334a2019a9e7d52c3bd5f4099a4b136ed84132e12542f8d00ae5fc9068894153393465d7e6f6ecbfdfd5901ba9b52af3c1
SSDEEP

24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8BoC09aYCmcxYraECNlCOq3vzZv3V:ROdWCCi7/rahwNUnj7Zq6pf

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 45 IoCs

miner

resource	yara_rule
behavioral2/memory/4184-140-0x00007FF6B4FB0000-0x00007FF6B5301000-memory.dmp	xmrig
behavioral2/memory/4488-239-0x00007FF690480000-0x00007FF6907D1000-memory.dmp	xmrig
behavioral2/memory/4404-238-0x00007FF753AF0000-0x00007FF753E41000-memory.dmp	xmrig
behavioral2/memory/3608-209-0x00007FF7FAE30000-0x00007FF7FB181000-memory.dmp	xmrig
behavioral2/memory/2348-276-0x00007FF6084C0000-0x00007FF608811000-memory.dmp	xmrig
behavioral2/memory/2864-311-0x00007FF6DD480000-0x00007FF6DD7D1000-memory.dmp	xmrig
behavioral2/memory/4944-263-0x00007FF6DC450000-0x00007FF6DC7A1000-memory.dmp	xmrig
behavioral2/memory/4464-243-0x00007FF7604C0000-0x00007FF760811000-memory.dmp	xmrig
behavioral2/memory/4660-182-0x00007FF6AFD00000-0x00007FF6B0051000-memory.dmp	xmrig
behavioral2/memory/3604-168-0x00007FF6EF360000-0x00007FF6EF6B1000-memory.dmp	xmrig
behavioral2/memory/2584-160-0x00007FF6C6100000-0x00007FF6C6451000-memory.dmp	xmrig
behavioral2/memory/3304-148-0x00007FF6DA6A0000-0x00007FF6DA9F1000-memory.dmp	xmrig
behavioral2/memory/2680-145-0x00007FF79F9D0000-0x00007FF79FD21000-memory.dmp	xmrig
behavioral2/memory/3592-117-0x00007FF6229C0000-0x00007FF622D11000-memory.dmp	xmrig
behavioral2/memory/224-73-0x00007FF710A50000-0x00007FF710DA1000-memory.dmp	xmrig
behavioral2/memory/3268-2131-0x00007FF653DB0000-0x00007FF654101000-memory.dmp	xmrig
behavioral2/memory/4944-2136-0x00007FF6DC450000-0x00007FF6DC7A1000-memory.dmp	xmrig
behavioral2/memory/3268-2138-0x00007FF653DB0000-0x00007FF654101000-memory.dmp	xmrig
behavioral2/memory/4644-2141-0x00007FF725B10000-0x00007FF725E61000-memory.dmp	xmrig
behavioral2/memory/2128-2142-0x00007FF737C40000-0x00007FF737F91000-memory.dmp	xmrig
behavioral2/memory/3616-2146-0x00007FF7E3A80000-0x00007FF7E3DD1000-memory.dmp	xmrig
behavioral2/memory/2340-2145-0x00007FF7B4C30000-0x00007FF7B4F81000-memory.dmp	xmrig
behavioral2/memory/224-2148-0x00007FF710A50000-0x00007FF710DA1000-memory.dmp	xmrig
behavioral2/memory/788-2152-0x00007FF7285E0000-0x00007FF728931000-memory.dmp	xmrig
behavioral2/memory/2680-2156-0x00007FF79F9D0000-0x00007FF79FD21000-memory.dmp	xmrig
behavioral2/memory/4184-2154-0x00007FF6B4FB0000-0x00007FF6B5301000-memory.dmp	xmrig
behavioral2/memory/1836-2151-0x00007FF6253E0000-0x00007FF625731000-memory.dmp	xmrig
behavioral2/memory/4556-2158-0x00007FF77C860000-0x00007FF77CBB1000-memory.dmp	xmrig
behavioral2/memory/1520-2162-0x00007FF6A4D50000-0x00007FF6A50A1000-memory.dmp	xmrig
behavioral2/memory/2768-2161-0x00007FF6D68B0000-0x00007FF6D6C01000-memory.dmp	xmrig
behavioral2/memory/4548-2166-0x00007FF6B1440000-0x00007FF6B1791000-memory.dmp	xmrig
behavioral2/memory/2984-2170-0x00007FF778CF0000-0x00007FF779041000-memory.dmp	xmrig
behavioral2/memory/3592-2168-0x00007FF6229C0000-0x00007FF622D11000-memory.dmp	xmrig
behavioral2/memory/2584-2165-0x00007FF6C6100000-0x00007FF6C6451000-memory.dmp	xmrig
behavioral2/memory/3604-2181-0x00007FF6EF360000-0x00007FF6EF6B1000-memory.dmp	xmrig
behavioral2/memory/2592-2182-0x00007FF6F9E50000-0x00007FF6FA1A1000-memory.dmp	xmrig
behavioral2/memory/2348-2184-0x00007FF6084C0000-0x00007FF608811000-memory.dmp	xmrig
behavioral2/memory/4404-2186-0x00007FF753AF0000-0x00007FF753E41000-memory.dmp	xmrig
behavioral2/memory/4660-2179-0x00007FF6AFD00000-0x00007FF6B0051000-memory.dmp	xmrig
behavioral2/memory/3608-2177-0x00007FF7FAE30000-0x00007FF7FB181000-memory.dmp	xmrig
behavioral2/memory/3752-2175-0x00007FF7128A0000-0x00007FF712BF1000-memory.dmp	xmrig
behavioral2/memory/4464-2191-0x00007FF7604C0000-0x00007FF760811000-memory.dmp	xmrig
behavioral2/memory/4488-2189-0x00007FF690480000-0x00007FF6907D1000-memory.dmp	xmrig
behavioral2/memory/2600-2195-0x00007FF7EB5F0000-0x00007FF7EB941000-memory.dmp	xmrig
behavioral2/memory/2864-2207-0x00007FF6DD480000-0x00007FF6DD7D1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4944	hJcxdbg.exe
3268	twSjnlQ.exe
2128	GOIJtwE.exe
4644	XyLPHtO.exe
3616	iLJYcDy.exe
2340	jNgGZMO.exe
788	tdAUmPo.exe
224	NGDOIui.exe
1836	LyIFwlQ.exe
4184	zUYvkdY.exe
2680	OKEhlsL.exe
2768	TDuCTvM.exe
4556	vwungCW.exe
1520	OpxedMB.exe
2584	fNnehyj.exe
4548	yZIOWJW.exe
2984	itQCTxn.exe
3592	FWcTfwe.exe
3604	onfImtq.exe
2600	EQdQnfr.exe
4660	GiKxLHH.exe
3752	swDsdtK.exe
3608	vmctFot.exe
2592	sXHIJSW.exe
2348	JcCHCXg.exe
4404	aPxLnCB.exe
4488	joEEuVv.exe
2864	ARdjOZS.exe
4464	JoTFydd.exe
656	tyUDVub.exe
2828	BPZhJvQ.exe
1552	sbqoLQY.exe
832	NYohHnu.exe
3788	IYnAhZW.exe
468	CZiUKsW.exe
4352	EpJFLoz.exe
5008	RmRSppu.exe
3880	tprVtQo.exe
2668	VVZvxTI.exe
2724	JLheIin.exe
2260	AXtllUN.exe
4020	wQVnWPF.exe
2068	PePPpMr.exe
1656	RGFeAkE.exe
3780	wjPGENC.exe
2672	MvrTLtH.exe
3820	AgFvjMR.exe
3528	qqgKvuq.exe
984	xmTRteZ.exe
1492	jvEOLOz.exe
3948	BoJILXM.exe
4432	rwnCxwr.exe
860	nRaikfM.exe
5084	qqatLYl.exe
5132	KzEXsbm.exe
5148	qioRexZ.exe
5164	PQirpKv.exe
5188	arCilGd.exe
5260	jIityHH.exe
5284	mDTaimd.exe
5308	Ipuruzb.exe
5360	ZtktgNq.exe
5384	uLGHpUu.exe
5416	ciSbCEo.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3304-0-0x00007FF6DA6A0000-0x00007FF6DA9F1000-memory.dmp	upx
behavioral2/files/0x000b000000023225-4.dat	upx
behavioral2/files/0x0007000000023256-14.dat	upx
behavioral2/memory/4944-11-0x00007FF6DC450000-0x00007FF6DC7A1000-memory.dmp	upx
behavioral2/files/0x0007000000023258-26.dat	upx
behavioral2/files/0x0007000000023257-27.dat	upx
behavioral2/memory/3616-35-0x00007FF7E3A80000-0x00007FF7E3DD1000-memory.dmp	upx
behavioral2/files/0x0007000000023259-45.dat	upx
behavioral2/files/0x000700000002325b-50.dat	upx
behavioral2/files/0x000700000002325d-65.dat	upx
behavioral2/files/0x000700000002325f-75.dat	upx
behavioral2/memory/2768-79-0x00007FF6D68B0000-0x00007FF6D6C01000-memory.dmp	upx
behavioral2/files/0x0007000000023264-99.dat	upx
behavioral2/memory/4548-103-0x00007FF6B1440000-0x00007FF6B1791000-memory.dmp	upx
behavioral2/files/0x0007000000023266-118.dat	upx
behavioral2/files/0x000700000002326a-129.dat	upx
behavioral2/files/0x0007000000023269-136.dat	upx
behavioral2/memory/4184-140-0x00007FF6B4FB0000-0x00007FF6B5301000-memory.dmp	upx
behavioral2/files/0x000700000002326d-173.dat	upx
behavioral2/files/0x000700000002326f-188.dat	upx
behavioral2/memory/4488-239-0x00007FF690480000-0x00007FF6907D1000-memory.dmp	upx
behavioral2/memory/4404-238-0x00007FF753AF0000-0x00007FF753E41000-memory.dmp	upx
behavioral2/memory/3608-209-0x00007FF7FAE30000-0x00007FF7FB181000-memory.dmp	upx
behavioral2/files/0x0007000000023272-198.dat	upx
behavioral2/files/0x0007000000023271-196.dat	upx
behavioral2/files/0x0007000000023270-193.dat	upx
behavioral2/memory/2348-276-0x00007FF6084C0000-0x00007FF608811000-memory.dmp	upx
behavioral2/memory/2864-311-0x00007FF6DD480000-0x00007FF6DD7D1000-memory.dmp	upx
behavioral2/memory/4944-263-0x00007FF6DC450000-0x00007FF6DC7A1000-memory.dmp	upx
behavioral2/memory/4464-243-0x00007FF7604C0000-0x00007FF760811000-memory.dmp	upx
behavioral2/memory/4660-182-0x00007FF6AFD00000-0x00007FF6B0051000-memory.dmp	upx
behavioral2/files/0x000700000002326c-171.dat	upx
behavioral2/files/0x000700000002326e-185.dat	upx
behavioral2/memory/3604-168-0x00007FF6EF360000-0x00007FF6EF6B1000-memory.dmp	upx
behavioral2/memory/2584-160-0x00007FF6C6100000-0x00007FF6C6451000-memory.dmp	upx
behavioral2/files/0x000700000002326b-169.dat	upx
behavioral2/memory/3304-148-0x00007FF6DA6A0000-0x00007FF6DA9F1000-memory.dmp	upx
behavioral2/memory/2680-145-0x00007FF79F9D0000-0x00007FF79FD21000-memory.dmp	upx
behavioral2/memory/2592-135-0x00007FF6F9E50000-0x00007FF6FA1A1000-memory.dmp	upx
behavioral2/files/0x0007000000023268-133.dat	upx
behavioral2/files/0x0007000000023267-131.dat	upx
behavioral2/memory/3752-130-0x00007FF7128A0000-0x00007FF712BF1000-memory.dmp	upx
behavioral2/files/0x0007000000023265-126.dat	upx
behavioral2/memory/2600-125-0x00007FF7EB5F0000-0x00007FF7EB941000-memory.dmp	upx
behavioral2/memory/3592-117-0x00007FF6229C0000-0x00007FF622D11000-memory.dmp	upx
behavioral2/memory/2984-114-0x00007FF778CF0000-0x00007FF779041000-memory.dmp	upx
behavioral2/files/0x0007000000023263-108.dat	upx
behavioral2/files/0x0007000000023262-106.dat	upx
behavioral2/memory/1520-100-0x00007FF6A4D50000-0x00007FF6A50A1000-memory.dmp	upx
behavioral2/files/0x0007000000023261-104.dat	upx
behavioral2/files/0x0007000000023260-91.dat	upx
behavioral2/memory/4556-86-0x00007FF77C860000-0x00007FF77CBB1000-memory.dmp	upx
behavioral2/files/0x000700000002325e-74.dat	upx
behavioral2/memory/224-73-0x00007FF710A50000-0x00007FF710DA1000-memory.dmp	upx
behavioral2/files/0x0008000000023253-71.dat	upx
behavioral2/files/0x000700000002325c-62.dat	upx
behavioral2/files/0x000700000002325a-55.dat	upx
behavioral2/memory/1836-49-0x00007FF6253E0000-0x00007FF625731000-memory.dmp	upx
behavioral2/memory/788-43-0x00007FF7285E0000-0x00007FF728931000-memory.dmp	upx
behavioral2/memory/2340-40-0x00007FF7B4C30000-0x00007FF7B4F81000-memory.dmp	upx
behavioral2/memory/4644-31-0x00007FF725B10000-0x00007FF725E61000-memory.dmp	upx
behavioral2/memory/2128-21-0x00007FF737C40000-0x00007FF737F91000-memory.dmp	upx
behavioral2/memory/3268-17-0x00007FF653DB0000-0x00007FF654101000-memory.dmp	upx
behavioral2/files/0x0008000000023255-15.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\qKCNFHY.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\ABjBbiD.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\puErxGE.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\iqydbhJ.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\pmERilp.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\UXWFFdU.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\NGDOIui.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\RmRSppu.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\JuMVswb.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\eaJCgYx.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\AyOdDXH.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\LWYkvcB.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\JrZCyMn.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\BjYzmtl.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\MfMPmxT.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\rmyfYpB.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\UckVNeU.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\sECaLHT.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\lOpCOih.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\tHeeNnE.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\gngYDVD.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZnJzukC.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\XCCFOxg.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\PwllVHn.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\VVHgnwN.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\tZFrrrf.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\hAqCZxG.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\dcaBxfC.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\FarbfgZ.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\UXMGKRa.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\BlCVWZO.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\QtNZptG.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\mJDSnrY.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\zpAeCWH.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\tdAUmPo.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\LyZMJQl.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\AvxVZkz.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\xBmwqhR.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\RcAycsb.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\qAePxZM.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\sbqoLQY.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\hIwPOMh.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\fuNRHjZ.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\wsayHHc.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\ODILQdZ.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\xxJuLwm.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\ugYrFYL.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\arCilGd.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\rJGhkMy.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\kixxTbT.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\UAAzKcI.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\khbKuEr.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\EiMkgOe.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\CqrWyQh.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\eawuvpA.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\nxRsnZQ.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\FsRvhqo.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\DglyzGo.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\LpQelqy.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\RjPuqly.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\ToWrpEk.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\wiXFHLW.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\KnuDNEp.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
File created	C:\Windows\System\tbfGehx.exe	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 4944	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	93
PID 3304 wrote to memory of 4944	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	93
PID 3304 wrote to memory of 3268	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	94
PID 3304 wrote to memory of 3268	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	94
PID 3304 wrote to memory of 2128	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	95
PID 3304 wrote to memory of 2128	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	95
PID 3304 wrote to memory of 4644	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	96
PID 3304 wrote to memory of 4644	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	96
PID 3304 wrote to memory of 3616	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	97
PID 3304 wrote to memory of 3616	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	97
PID 3304 wrote to memory of 2340	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	98
PID 3304 wrote to memory of 2340	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	98
PID 3304 wrote to memory of 788	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	99
PID 3304 wrote to memory of 788	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	99
PID 3304 wrote to memory of 224	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	100
PID 3304 wrote to memory of 224	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	100
PID 3304 wrote to memory of 1836	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	101
PID 3304 wrote to memory of 1836	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	101
PID 3304 wrote to memory of 4184	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	102
PID 3304 wrote to memory of 4184	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	102
PID 3304 wrote to memory of 2680	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	103
PID 3304 wrote to memory of 2680	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	103
PID 3304 wrote to memory of 2768	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	104
PID 3304 wrote to memory of 2768	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	104
PID 3304 wrote to memory of 4556	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	105
PID 3304 wrote to memory of 4556	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	105
PID 3304 wrote to memory of 1520	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	106
PID 3304 wrote to memory of 1520	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	106
PID 3304 wrote to memory of 2584	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	107
PID 3304 wrote to memory of 2584	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	107
PID 3304 wrote to memory of 4548	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	108
PID 3304 wrote to memory of 4548	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	108
PID 3304 wrote to memory of 2984	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	109
PID 3304 wrote to memory of 2984	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	109
PID 3304 wrote to memory of 3592	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	110
PID 3304 wrote to memory of 3592	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	110
PID 3304 wrote to memory of 3604	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	111
PID 3304 wrote to memory of 3604	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	111
PID 3304 wrote to memory of 2600	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	112
PID 3304 wrote to memory of 2600	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	112
PID 3304 wrote to memory of 4660	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	113
PID 3304 wrote to memory of 4660	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	113
PID 3304 wrote to memory of 3752	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	114
PID 3304 wrote to memory of 3752	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	114
PID 3304 wrote to memory of 3608	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	115
PID 3304 wrote to memory of 3608	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	115
PID 3304 wrote to memory of 2592	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	116
PID 3304 wrote to memory of 2592	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	116
PID 3304 wrote to memory of 2348	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	117
PID 3304 wrote to memory of 2348	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	117
PID 3304 wrote to memory of 4404	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	118
PID 3304 wrote to memory of 4404	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	118
PID 3304 wrote to memory of 4488	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	119
PID 3304 wrote to memory of 4488	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	119
PID 3304 wrote to memory of 2864	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	120
PID 3304 wrote to memory of 2864	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	120
PID 3304 wrote to memory of 4464	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	121
PID 3304 wrote to memory of 4464	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	121
PID 3304 wrote to memory of 656	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	122
PID 3304 wrote to memory of 656	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	122
PID 3304 wrote to memory of 2828	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	123
PID 3304 wrote to memory of 2828	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	123
PID 3304 wrote to memory of 1552	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	124
PID 3304 wrote to memory of 1552	3304	03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe	124

C:\Users\Admin\AppData\Local\Temp\03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\03578db55de02156f5b6401a096919d0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\System\hJcxdbg.exe
  C:\Windows\System\hJcxdbg.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\twSjnlQ.exe
  C:\Windows\System\twSjnlQ.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\GOIJtwE.exe
  C:\Windows\System\GOIJtwE.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\XyLPHtO.exe
  C:\Windows\System\XyLPHtO.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\iLJYcDy.exe
  C:\Windows\System\iLJYcDy.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\jNgGZMO.exe
  C:\Windows\System\jNgGZMO.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\tdAUmPo.exe
  C:\Windows\System\tdAUmPo.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\NGDOIui.exe
  C:\Windows\System\NGDOIui.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\LyIFwlQ.exe
  C:\Windows\System\LyIFwlQ.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\zUYvkdY.exe
  C:\Windows\System\zUYvkdY.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\OKEhlsL.exe
  C:\Windows\System\OKEhlsL.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\TDuCTvM.exe
  C:\Windows\System\TDuCTvM.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\vwungCW.exe
  C:\Windows\System\vwungCW.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\OpxedMB.exe
  C:\Windows\System\OpxedMB.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\fNnehyj.exe
  C:\Windows\System\fNnehyj.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\yZIOWJW.exe
  C:\Windows\System\yZIOWJW.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\itQCTxn.exe
  C:\Windows\System\itQCTxn.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\FWcTfwe.exe
  C:\Windows\System\FWcTfwe.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\onfImtq.exe
  C:\Windows\System\onfImtq.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\EQdQnfr.exe
  C:\Windows\System\EQdQnfr.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\GiKxLHH.exe
  C:\Windows\System\GiKxLHH.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\swDsdtK.exe
  C:\Windows\System\swDsdtK.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\vmctFot.exe
  C:\Windows\System\vmctFot.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\sXHIJSW.exe
  C:\Windows\System\sXHIJSW.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\JcCHCXg.exe
  C:\Windows\System\JcCHCXg.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\aPxLnCB.exe
  C:\Windows\System\aPxLnCB.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\joEEuVv.exe
  C:\Windows\System\joEEuVv.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\ARdjOZS.exe
  C:\Windows\System\ARdjOZS.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\JoTFydd.exe
  C:\Windows\System\JoTFydd.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\tyUDVub.exe
  C:\Windows\System\tyUDVub.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\BPZhJvQ.exe
  C:\Windows\System\BPZhJvQ.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\sbqoLQY.exe
  C:\Windows\System\sbqoLQY.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\VVZvxTI.exe
  C:\Windows\System\VVZvxTI.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\NYohHnu.exe
  C:\Windows\System\NYohHnu.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\IYnAhZW.exe
  C:\Windows\System\IYnAhZW.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\CZiUKsW.exe
  C:\Windows\System\CZiUKsW.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\EpJFLoz.exe
  C:\Windows\System\EpJFLoz.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\RmRSppu.exe
  C:\Windows\System\RmRSppu.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\tprVtQo.exe
  C:\Windows\System\tprVtQo.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\JLheIin.exe
  C:\Windows\System\JLheIin.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\AXtllUN.exe
  C:\Windows\System\AXtllUN.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\wQVnWPF.exe
  C:\Windows\System\wQVnWPF.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\PePPpMr.exe
  C:\Windows\System\PePPpMr.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\RGFeAkE.exe
  C:\Windows\System\RGFeAkE.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\wjPGENC.exe
  C:\Windows\System\wjPGENC.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\MvrTLtH.exe
  C:\Windows\System\MvrTLtH.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\AgFvjMR.exe
  C:\Windows\System\AgFvjMR.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\qqgKvuq.exe
  C:\Windows\System\qqgKvuq.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\xmTRteZ.exe
  C:\Windows\System\xmTRteZ.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\jvEOLOz.exe
  C:\Windows\System\jvEOLOz.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\BoJILXM.exe
  C:\Windows\System\BoJILXM.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\rwnCxwr.exe
  C:\Windows\System\rwnCxwr.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\nRaikfM.exe
  C:\Windows\System\nRaikfM.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\qqatLYl.exe
  C:\Windows\System\qqatLYl.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\KzEXsbm.exe
  C:\Windows\System\KzEXsbm.exe
  2⤵
  - Executes dropped EXE
  PID:5132
- C:\Windows\System\qioRexZ.exe
  C:\Windows\System\qioRexZ.exe
  2⤵
  - Executes dropped EXE
  PID:5148
- C:\Windows\System\PQirpKv.exe
  C:\Windows\System\PQirpKv.exe
  2⤵
  - Executes dropped EXE
  PID:5164
- C:\Windows\System\arCilGd.exe
  C:\Windows\System\arCilGd.exe
  2⤵
  - Executes dropped EXE
  PID:5188
- C:\Windows\System\jIityHH.exe
  C:\Windows\System\jIityHH.exe
  2⤵
  - Executes dropped EXE
  PID:5260
- C:\Windows\System\mDTaimd.exe
  C:\Windows\System\mDTaimd.exe
  2⤵
  - Executes dropped EXE
  PID:5284
- C:\Windows\System\Ipuruzb.exe
  C:\Windows\System\Ipuruzb.exe
  2⤵
  - Executes dropped EXE
  PID:5308
- C:\Windows\System\ZtktgNq.exe
  C:\Windows\System\ZtktgNq.exe
  2⤵
  - Executes dropped EXE
  PID:5360
- C:\Windows\System\uLGHpUu.exe
  C:\Windows\System\uLGHpUu.exe
  2⤵
  - Executes dropped EXE
  PID:5384
- C:\Windows\System\ciSbCEo.exe
  C:\Windows\System\ciSbCEo.exe
  2⤵
  - Executes dropped EXE
  PID:5416
- C:\Windows\System\hDzIuOW.exe
  C:\Windows\System\hDzIuOW.exe
  2⤵
  PID:5440
- C:\Windows\System\KAnBHMT.exe
  C:\Windows\System\KAnBHMT.exe
  2⤵
  PID:5464
- C:\Windows\System\ESwcuam.exe
  C:\Windows\System\ESwcuam.exe
  2⤵
  PID:5480
- C:\Windows\System\VauLxXQ.exe
  C:\Windows\System\VauLxXQ.exe
  2⤵
  PID:5512
- C:\Windows\System\xuyaPYp.exe
  C:\Windows\System\xuyaPYp.exe
  2⤵
  PID:5532
- C:\Windows\System\YScItvV.exe
  C:\Windows\System\YScItvV.exe
  2⤵
  PID:5560
- C:\Windows\System\FarbfgZ.exe
  C:\Windows\System\FarbfgZ.exe
  2⤵
  PID:5640
- C:\Windows\System\VjsFMUU.exe
  C:\Windows\System\VjsFMUU.exe
  2⤵
  PID:5660
- C:\Windows\System\AIdFFsh.exe
  C:\Windows\System\AIdFFsh.exe
  2⤵
  PID:5676
- C:\Windows\System\cVnqeqq.exe
  C:\Windows\System\cVnqeqq.exe
  2⤵
  PID:5700
- C:\Windows\System\QZfdNLp.exe
  C:\Windows\System\QZfdNLp.exe
  2⤵
  PID:5724
- C:\Windows\System\rGxLSYp.exe
  C:\Windows\System\rGxLSYp.exe
  2⤵
  PID:5740
- C:\Windows\System\qKCNFHY.exe
  C:\Windows\System\qKCNFHY.exe
  2⤵
  PID:5760
- C:\Windows\System\EAxAswN.exe
  C:\Windows\System\EAxAswN.exe
  2⤵
  PID:5784
- C:\Windows\System\DHvVUaZ.exe
  C:\Windows\System\DHvVUaZ.exe
  2⤵
  PID:5808
- C:\Windows\System\NMIDXjC.exe
  C:\Windows\System\NMIDXjC.exe
  2⤵
  PID:5840
- C:\Windows\System\XCCFOxg.exe
  C:\Windows\System\XCCFOxg.exe
  2⤵
  PID:5860
- C:\Windows\System\hIwPOMh.exe
  C:\Windows\System\hIwPOMh.exe
  2⤵
  PID:5912
- C:\Windows\System\VjIHner.exe
  C:\Windows\System\VjIHner.exe
  2⤵
  PID:5932
- C:\Windows\System\pFdlhwi.exe
  C:\Windows\System\pFdlhwi.exe
  2⤵
  PID:5948
- C:\Windows\System\fuNRHjZ.exe
  C:\Windows\System\fuNRHjZ.exe
  2⤵
  PID:5972
- C:\Windows\System\uMBJkmk.exe
  C:\Windows\System\uMBJkmk.exe
  2⤵
  PID:5992
- C:\Windows\System\KLzYFwj.exe
  C:\Windows\System\KLzYFwj.exe
  2⤵
  PID:6016
- C:\Windows\System\JuMVswb.exe
  C:\Windows\System\JuMVswb.exe
  2⤵
  PID:6032
- C:\Windows\System\VWnQRFw.exe
  C:\Windows\System\VWnQRFw.exe
  2⤵
  PID:6048
- C:\Windows\System\qidIwwQ.exe
  C:\Windows\System\qidIwwQ.exe
  2⤵
  PID:6072
- C:\Windows\System\JGzjuWz.exe
  C:\Windows\System\JGzjuWz.exe
  2⤵
  PID:6112
- C:\Windows\System\DbcwNRM.exe
  C:\Windows\System\DbcwNRM.exe
  2⤵
  PID:6132
- C:\Windows\System\jgOdiDj.exe
  C:\Windows\System\jgOdiDj.exe
  2⤵
  PID:5716
- C:\Windows\System\JtIxbPg.exe
  C:\Windows\System\JtIxbPg.exe
  2⤵
  PID:5792
- C:\Windows\System\ewUXydO.exe
  C:\Windows\System\ewUXydO.exe
  2⤵
  PID:5904
- C:\Windows\System\UXMGKRa.exe
  C:\Windows\System\UXMGKRa.exe
  2⤵
  PID:5944
- C:\Windows\System\tnbroKX.exe
  C:\Windows\System\tnbroKX.exe
  2⤵
  PID:6004
- C:\Windows\System\JdJtWVz.exe
  C:\Windows\System\JdJtWVz.exe
  2⤵
  PID:6100
- C:\Windows\System\ENzpZOu.exe
  C:\Windows\System\ENzpZOu.exe
  2⤵
  PID:2800
- C:\Windows\System\cpUkGaY.exe
  C:\Windows\System\cpUkGaY.exe
  2⤵
  PID:3288
- C:\Windows\System\bvEXbKV.exe
  C:\Windows\System\bvEXbKV.exe
  2⤵
  PID:1252
- C:\Windows\System\YToArCC.exe
  C:\Windows\System\YToArCC.exe
  2⤵
  PID:1536
- C:\Windows\System\UAAzKcI.exe
  C:\Windows\System\UAAzKcI.exe
  2⤵
  PID:2152
- C:\Windows\System\LprrMju.exe
  C:\Windows\System\LprrMju.exe
  2⤵
  PID:3460
- C:\Windows\System\xHMZCOI.exe
  C:\Windows\System\xHMZCOI.exe
  2⤵
  PID:1828
- C:\Windows\System\RjPuqly.exe
  C:\Windows\System\RjPuqly.exe
  2⤵
  PID:3584
- C:\Windows\System\WBliWJu.exe
  C:\Windows\System\WBliWJu.exe
  2⤵
  PID:2316
- C:\Windows\System\xzlZYgo.exe
  C:\Windows\System\xzlZYgo.exe
  2⤵
  PID:6024
- C:\Windows\System\SKPJwFq.exe
  C:\Windows\System\SKPJwFq.exe
  2⤵
  PID:1104
- C:\Windows\System\lIKUifS.exe
  C:\Windows\System\lIKUifS.exe
  2⤵
  PID:1432
- C:\Windows\System\sXIWsyI.exe
  C:\Windows\System\sXIWsyI.exe
  2⤵
  PID:4888
- C:\Windows\System\NAjimQN.exe
  C:\Windows\System\NAjimQN.exe
  2⤵
  PID:3624
- C:\Windows\System\DbBVGzc.exe
  C:\Windows\System\DbBVGzc.exe
  2⤵
  PID:4840
- C:\Windows\System\lulvBrk.exe
  C:\Windows\System\lulvBrk.exe
  2⤵
  PID:4304
- C:\Windows\System\dYetTOS.exe
  C:\Windows\System\dYetTOS.exe
  2⤵
  PID:3732
- C:\Windows\System\dNmEFKi.exe
  C:\Windows\System\dNmEFKi.exe
  2⤵
  PID:5316
- C:\Windows\System\kskZpvW.exe
  C:\Windows\System\kskZpvW.exe
  2⤵
  PID:5568
- C:\Windows\System\BegKjWQ.exe
  C:\Windows\System\BegKjWQ.exe
  2⤵
  PID:5396
- C:\Windows\System\LXNRUzr.exe
  C:\Windows\System\LXNRUzr.exe
  2⤵
  PID:5472
- C:\Windows\System\GqqTkKA.exe
  C:\Windows\System\GqqTkKA.exe
  2⤵
  PID:5668
- C:\Windows\System\SQdPBrT.exe
  C:\Windows\System\SQdPBrT.exe
  2⤵
  PID:5712
- C:\Windows\System\TppawcQ.exe
  C:\Windows\System\TppawcQ.exe
  2⤵
  PID:5736
- C:\Windows\System\VZQmoor.exe
  C:\Windows\System\VZQmoor.exe
  2⤵
  PID:5880
- C:\Windows\System\ZPbRNFe.exe
  C:\Windows\System\ZPbRNFe.exe
  2⤵
  PID:5980
- C:\Windows\System\IyGNFbf.exe
  C:\Windows\System\IyGNFbf.exe
  2⤵
  PID:6096
- C:\Windows\System\AWOWuCa.exe
  C:\Windows\System\AWOWuCa.exe
  2⤵
  PID:4940
- C:\Windows\System\UckVNeU.exe
  C:\Windows\System\UckVNeU.exe
  2⤵
  PID:1980
- C:\Windows\System\YdHBXlP.exe
  C:\Windows\System\YdHBXlP.exe
  2⤵
  PID:732
- C:\Windows\System\niWVTvO.exe
  C:\Windows\System\niWVTvO.exe
  2⤵
  PID:3680
- C:\Windows\System\sTByGAC.exe
  C:\Windows\System\sTByGAC.exe
  2⤵
  PID:2244
- C:\Windows\System\KQkXVFY.exe
  C:\Windows\System\KQkXVFY.exe
  2⤵
  PID:1560
- C:\Windows\System\xaoIsmj.exe
  C:\Windows\System\xaoIsmj.exe
  2⤵
  PID:4708
- C:\Windows\System\ZwAUUBD.exe
  C:\Windows\System\ZwAUUBD.exe
  2⤵
  PID:4384
- C:\Windows\System\UqWbmBO.exe
  C:\Windows\System\UqWbmBO.exe
  2⤵
  PID:5336
- C:\Windows\System\ToWrpEk.exe
  C:\Windows\System\ToWrpEk.exe
  2⤵
  PID:6040
- C:\Windows\System\haDrTrx.exe
  C:\Windows\System\haDrTrx.exe
  2⤵
  PID:5492
- C:\Windows\System\jqSXOOr.exe
  C:\Windows\System\jqSXOOr.exe
  2⤵
  PID:5636
- C:\Windows\System\VInnbrH.exe
  C:\Windows\System\VInnbrH.exe
  2⤵
  PID:5184
- C:\Windows\System\Arsvgoc.exe
  C:\Windows\System\Arsvgoc.exe
  2⤵
  PID:5356
- C:\Windows\System\mYvAOcY.exe
  C:\Windows\System\mYvAOcY.exe
  2⤵
  PID:6148
- C:\Windows\System\OXnSxFK.exe
  C:\Windows\System\OXnSxFK.exe
  2⤵
  PID:6168
- C:\Windows\System\ovtrXpn.exe
  C:\Windows\System\ovtrXpn.exe
  2⤵
  PID:6192
- C:\Windows\System\xSGUzUE.exe
  C:\Windows\System\xSGUzUE.exe
  2⤵
  PID:6212
- C:\Windows\System\EGpbIld.exe
  C:\Windows\System\EGpbIld.exe
  2⤵
  PID:6232
- C:\Windows\System\CscxdUr.exe
  C:\Windows\System\CscxdUr.exe
  2⤵
  PID:6256
- C:\Windows\System\wsayHHc.exe
  C:\Windows\System\wsayHHc.exe
  2⤵
  PID:6280
- C:\Windows\System\sECaLHT.exe
  C:\Windows\System\sECaLHT.exe
  2⤵
  PID:6300
- C:\Windows\System\ACEbgzn.exe
  C:\Windows\System\ACEbgzn.exe
  2⤵
  PID:6324
- C:\Windows\System\fEGzOTq.exe
  C:\Windows\System\fEGzOTq.exe
  2⤵
  PID:6344
- C:\Windows\System\zgzAiBU.exe
  C:\Windows\System\zgzAiBU.exe
  2⤵
  PID:6364
- C:\Windows\System\jBKJGbz.exe
  C:\Windows\System\jBKJGbz.exe
  2⤵
  PID:6388
- C:\Windows\System\rnSxZfA.exe
  C:\Windows\System\rnSxZfA.exe
  2⤵
  PID:6412
- C:\Windows\System\bkIqqhr.exe
  C:\Windows\System\bkIqqhr.exe
  2⤵
  PID:6432
- C:\Windows\System\fImodyq.exe
  C:\Windows\System\fImodyq.exe
  2⤵
  PID:6452
- C:\Windows\System\EaEswLO.exe
  C:\Windows\System\EaEswLO.exe
  2⤵
  PID:6504
- C:\Windows\System\kOFWMDg.exe
  C:\Windows\System\kOFWMDg.exe
  2⤵
  PID:6540
- C:\Windows\System\JuvTccI.exe
  C:\Windows\System\JuvTccI.exe
  2⤵
  PID:6556
- C:\Windows\System\IwEVGrm.exe
  C:\Windows\System\IwEVGrm.exe
  2⤵
  PID:6572
- C:\Windows\System\eaJCgYx.exe
  C:\Windows\System\eaJCgYx.exe
  2⤵
  PID:6600
- C:\Windows\System\MpfjsKV.exe
  C:\Windows\System\MpfjsKV.exe
  2⤵
  PID:6624
- C:\Windows\System\JaqwzoP.exe
  C:\Windows\System\JaqwzoP.exe
  2⤵
  PID:6652
- C:\Windows\System\lVAbAGU.exe
  C:\Windows\System\lVAbAGU.exe
  2⤵
  PID:6676
- C:\Windows\System\lwIlbLe.exe
  C:\Windows\System\lwIlbLe.exe
  2⤵
  PID:6696
- C:\Windows\System\mxWuTrw.exe
  C:\Windows\System\mxWuTrw.exe
  2⤵
  PID:6720
- C:\Windows\System\PwllVHn.exe
  C:\Windows\System\PwllVHn.exe
  2⤵
  PID:6748
- C:\Windows\System\dQvIyVE.exe
  C:\Windows\System\dQvIyVE.exe
  2⤵
  PID:6772
- C:\Windows\System\CEVKEbm.exe
  C:\Windows\System\CEVKEbm.exe
  2⤵
  PID:6788
- C:\Windows\System\NCTnGkF.exe
  C:\Windows\System\NCTnGkF.exe
  2⤵
  PID:6816
- C:\Windows\System\frWxbTF.exe
  C:\Windows\System\frWxbTF.exe
  2⤵
  PID:6836
- C:\Windows\System\XJHPQWY.exe
  C:\Windows\System\XJHPQWY.exe
  2⤵
  PID:6860
- C:\Windows\System\CeQMSFo.exe
  C:\Windows\System\CeQMSFo.exe
  2⤵
  PID:6972
- C:\Windows\System\vzddIju.exe
  C:\Windows\System\vzddIju.exe
  2⤵
  PID:6988
- C:\Windows\System\QIdkzkl.exe
  C:\Windows\System\QIdkzkl.exe
  2⤵
  PID:7012
- C:\Windows\System\khbKuEr.exe
  C:\Windows\System\khbKuEr.exe
  2⤵
  PID:7032
- C:\Windows\System\wtLHahd.exe
  C:\Windows\System\wtLHahd.exe
  2⤵
  PID:7060
- C:\Windows\System\RhGmcWZ.exe
  C:\Windows\System\RhGmcWZ.exe
  2⤵
  PID:7088
- C:\Windows\System\oVbNobk.exe
  C:\Windows\System\oVbNobk.exe
  2⤵
  PID:7112
- C:\Windows\System\zbTrypc.exe
  C:\Windows\System\zbTrypc.exe
  2⤵
  PID:7132
- C:\Windows\System\SrtlShs.exe
  C:\Windows\System\SrtlShs.exe
  2⤵
  PID:5800
- C:\Windows\System\iONXuuQ.exe
  C:\Windows\System\iONXuuQ.exe
  2⤵
  PID:3368
- C:\Windows\System\JxfLxvD.exe
  C:\Windows\System\JxfLxvD.exe
  2⤵
  PID:5820
- C:\Windows\System\ciWVgKJ.exe
  C:\Windows\System\ciWVgKJ.exe
  2⤵
  PID:5340
- C:\Windows\System\MyyEGES.exe
  C:\Windows\System\MyyEGES.exe
  2⤵
  PID:6252
- C:\Windows\System\mYZAlLH.exe
  C:\Windows\System\mYZAlLH.exe
  2⤵
  PID:6240
- C:\Windows\System\DgsbKeY.exe
  C:\Windows\System\DgsbKeY.exe
  2⤵
  PID:6164
- C:\Windows\System\UmYSmzq.exe
  C:\Windows\System\UmYSmzq.exe
  2⤵
  PID:6356
- C:\Windows\System\ANcvfRS.exe
  C:\Windows\System\ANcvfRS.exe
  2⤵
  PID:5368
- C:\Windows\System\iEHOZmQ.exe
  C:\Windows\System\iEHOZmQ.exe
  2⤵
  PID:6288
- C:\Windows\System\pBvVzfS.exe
  C:\Windows\System\pBvVzfS.exe
  2⤵
  PID:6068
- C:\Windows\System\LXbsdUX.exe
  C:\Windows\System\LXbsdUX.exe
  2⤵
  PID:6424
- C:\Windows\System\hSNBIbo.exe
  C:\Windows\System\hSNBIbo.exe
  2⤵
  PID:6632
- C:\Windows\System\lOpCOih.exe
  C:\Windows\System\lOpCOih.exe
  2⤵
  PID:6688
- C:\Windows\System\DkMeNmv.exe
  C:\Windows\System\DkMeNmv.exe
  2⤵
  PID:6360
- C:\Windows\System\KzJuTQs.exe
  C:\Windows\System\KzJuTQs.exe
  2⤵
  PID:6580
- C:\Windows\System\pMHoPgu.exe
  C:\Windows\System\pMHoPgu.exe
  2⤵
  PID:6712
- C:\Windows\System\vGSeTEE.exe
  C:\Windows\System\vGSeTEE.exe
  2⤵
  PID:6516
- C:\Windows\System\pLUVvTF.exe
  C:\Windows\System\pLUVvTF.exe
  2⤵
  PID:6956
- C:\Windows\System\KzZnvFg.exe
  C:\Windows\System\KzZnvFg.exe
  2⤵
  PID:7004
- C:\Windows\System\oxctTqp.exe
  C:\Windows\System\oxctTqp.exe
  2⤵
  PID:6552
- C:\Windows\System\pssJRSi.exe
  C:\Windows\System\pssJRSi.exe
  2⤵
  PID:6588
- C:\Windows\System\tgOaDxH.exe
  C:\Windows\System\tgOaDxH.exe
  2⤵
  PID:5448
- C:\Windows\System\nxRsnZQ.exe
  C:\Windows\System\nxRsnZQ.exe
  2⤵
  PID:6228
- C:\Windows\System\oTKZlIR.exe
  C:\Windows\System\oTKZlIR.exe
  2⤵
  PID:2168
- C:\Windows\System\ErIDztt.exe
  C:\Windows\System\ErIDztt.exe
  2⤵
  PID:5392
- C:\Windows\System\TNyiXrn.exe
  C:\Windows\System\TNyiXrn.exe
  2⤵
  PID:7028
- C:\Windows\System\PTlUjMf.exe
  C:\Windows\System\PTlUjMf.exe
  2⤵
  PID:6876
- C:\Windows\System\NdMdrYe.exe
  C:\Windows\System\NdMdrYe.exe
  2⤵
  PID:7184
- C:\Windows\System\wZbXrTY.exe
  C:\Windows\System\wZbXrTY.exe
  2⤵
  PID:7200
- C:\Windows\System\YiRFFQU.exe
  C:\Windows\System\YiRFFQU.exe
  2⤵
  PID:7220
- C:\Windows\System\FKhMHDe.exe
  C:\Windows\System\FKhMHDe.exe
  2⤵
  PID:7244
- C:\Windows\System\jAtbqYS.exe
  C:\Windows\System\jAtbqYS.exe
  2⤵
  PID:7260
- C:\Windows\System\uTSmEsF.exe
  C:\Windows\System\uTSmEsF.exe
  2⤵
  PID:7280
- C:\Windows\System\hcchzgj.exe
  C:\Windows\System\hcchzgj.exe
  2⤵
  PID:7304
- C:\Windows\System\DgQLOOi.exe
  C:\Windows\System\DgQLOOi.exe
  2⤵
  PID:7328
- C:\Windows\System\eWwajPc.exe
  C:\Windows\System\eWwajPc.exe
  2⤵
  PID:7348
- C:\Windows\System\eCXwWGF.exe
  C:\Windows\System\eCXwWGF.exe
  2⤵
  PID:7368
- C:\Windows\System\wSciKvX.exe
  C:\Windows\System\wSciKvX.exe
  2⤵
  PID:7388
- C:\Windows\System\kDsEEBQ.exe
  C:\Windows\System\kDsEEBQ.exe
  2⤵
  PID:7412
- C:\Windows\System\HFvghAp.exe
  C:\Windows\System\HFvghAp.exe
  2⤵
  PID:7432
- C:\Windows\System\tBjhEft.exe
  C:\Windows\System\tBjhEft.exe
  2⤵
  PID:7456
- C:\Windows\System\EyVZpyh.exe
  C:\Windows\System\EyVZpyh.exe
  2⤵
  PID:7476
- C:\Windows\System\VnkZBhS.exe
  C:\Windows\System\VnkZBhS.exe
  2⤵
  PID:7496
- C:\Windows\System\skHWOOp.exe
  C:\Windows\System\skHWOOp.exe
  2⤵
  PID:7516
- C:\Windows\System\iJwYxMz.exe
  C:\Windows\System\iJwYxMz.exe
  2⤵
  PID:7536
- C:\Windows\System\eBEqjFt.exe
  C:\Windows\System\eBEqjFt.exe
  2⤵
  PID:7560
- C:\Windows\System\xHxloQE.exe
  C:\Windows\System\xHxloQE.exe
  2⤵
  PID:7576
- C:\Windows\System\atPEMYJ.exe
  C:\Windows\System\atPEMYJ.exe
  2⤵
  PID:7604
- C:\Windows\System\xNkUNBm.exe
  C:\Windows\System\xNkUNBm.exe
  2⤵
  PID:7624
- C:\Windows\System\kWYtaZV.exe
  C:\Windows\System\kWYtaZV.exe
  2⤵
  PID:7644
- C:\Windows\System\AFlYFxT.exe
  C:\Windows\System\AFlYFxT.exe
  2⤵
  PID:7668
- C:\Windows\System\OXVqasu.exe
  C:\Windows\System\OXVqasu.exe
  2⤵
  PID:7688
- C:\Windows\System\QFRZvRA.exe
  C:\Windows\System\QFRZvRA.exe
  2⤵
  PID:7708
- C:\Windows\System\pfpudNo.exe
  C:\Windows\System\pfpudNo.exe
  2⤵
  PID:7732
- C:\Windows\System\KKUjQfp.exe
  C:\Windows\System\KKUjQfp.exe
  2⤵
  PID:7752
- C:\Windows\System\qJVlZtp.exe
  C:\Windows\System\qJVlZtp.exe
  2⤵
  PID:7772
- C:\Windows\System\UssblbR.exe
  C:\Windows\System\UssblbR.exe
  2⤵
  PID:7800
- C:\Windows\System\vvVdhkM.exe
  C:\Windows\System\vvVdhkM.exe
  2⤵
  PID:7816
- C:\Windows\System\aPppSmS.exe
  C:\Windows\System\aPppSmS.exe
  2⤵
  PID:7836
- C:\Windows\System\GgFQkyr.exe
  C:\Windows\System\GgFQkyr.exe
  2⤵
  PID:7856
- C:\Windows\System\FngdRcg.exe
  C:\Windows\System\FngdRcg.exe
  2⤵
  PID:7876
- C:\Windows\System\QbAqaQR.exe
  C:\Windows\System\QbAqaQR.exe
  2⤵
  PID:7896
- C:\Windows\System\Wjrfdvh.exe
  C:\Windows\System\Wjrfdvh.exe
  2⤵
  PID:7924
- C:\Windows\System\rbucQkx.exe
  C:\Windows\System\rbucQkx.exe
  2⤵
  PID:7944
- C:\Windows\System\RrQPYwP.exe
  C:\Windows\System\RrQPYwP.exe
  2⤵
  PID:7960
- C:\Windows\System\PEIYUEo.exe
  C:\Windows\System\PEIYUEo.exe
  2⤵
  PID:7984
- C:\Windows\System\tKflKlX.exe
  C:\Windows\System\tKflKlX.exe
  2⤵
  PID:8000
- C:\Windows\System\jdmobbC.exe
  C:\Windows\System\jdmobbC.exe
  2⤵
  PID:8024
- C:\Windows\System\rJGhkMy.exe
  C:\Windows\System\rJGhkMy.exe
  2⤵
  PID:8044
- C:\Windows\System\sEKJzor.exe
  C:\Windows\System\sEKJzor.exe
  2⤵
  PID:8064
- C:\Windows\System\ZAGhuVk.exe
  C:\Windows\System\ZAGhuVk.exe
  2⤵
  PID:8084
- C:\Windows\System\IjtHaDc.exe
  C:\Windows\System\IjtHaDc.exe
  2⤵
  PID:8104
- C:\Windows\System\BpqINBg.exe
  C:\Windows\System\BpqINBg.exe
  2⤵
  PID:8132
- C:\Windows\System\OGisXzl.exe
  C:\Windows\System\OGisXzl.exe
  2⤵
  PID:8148
- C:\Windows\System\TMNAplq.exe
  C:\Windows\System\TMNAplq.exe
  2⤵
  PID:8168
- C:\Windows\System\EjLFlSx.exe
  C:\Windows\System\EjLFlSx.exe
  2⤵
  PID:8188
- C:\Windows\System\OFhZJzK.exe
  C:\Windows\System\OFhZJzK.exe
  2⤵
  PID:6904
- C:\Windows\System\GvapvPC.exe
  C:\Windows\System\GvapvPC.exe
  2⤵
  PID:6828
- C:\Windows\System\ZKWdDfW.exe
  C:\Windows\System\ZKWdDfW.exe
  2⤵
  PID:6208
- C:\Windows\System\AyOdDXH.exe
  C:\Windows\System\AyOdDXH.exe
  2⤵
  PID:6204
- C:\Windows\System\wiXFHLW.exe
  C:\Windows\System\wiXFHLW.exe
  2⤵
  PID:7048
- C:\Windows\System\yVhZagj.exe
  C:\Windows\System\yVhZagj.exe
  2⤵
  PID:7192
- C:\Windows\System\LJrUtfY.exe
  C:\Windows\System\LJrUtfY.exe
  2⤵
  PID:6672
- C:\Windows\System\IqGnSis.exe
  C:\Windows\System\IqGnSis.exe
  2⤵
  PID:7356
- C:\Windows\System\nEiBxdm.exe
  C:\Windows\System\nEiBxdm.exe
  2⤵
  PID:7396
- C:\Windows\System\iKSOOPQ.exe
  C:\Windows\System\iKSOOPQ.exe
  2⤵
  PID:7448
- C:\Windows\System\OMFwZaF.exe
  C:\Windows\System\OMFwZaF.exe
  2⤵
  PID:7504
- C:\Windows\System\FmWmJcL.exe
  C:\Windows\System\FmWmJcL.exe
  2⤵
  PID:7548
- C:\Windows\System\IeFHghz.exe
  C:\Windows\System\IeFHghz.exe
  2⤵
  PID:7568
- C:\Windows\System\kaKdgYY.exe
  C:\Windows\System\kaKdgYY.exe
  2⤵
  PID:6736
- C:\Windows\System\YisBQhM.exe
  C:\Windows\System\YisBQhM.exe
  2⤵
  PID:6120
- C:\Windows\System\VLGjwnR.exe
  C:\Windows\System\VLGjwnR.exe
  2⤵
  PID:7716
- C:\Windows\System\RXIJJeH.exe
  C:\Windows\System\RXIJJeH.exe
  2⤵
  PID:8216
- C:\Windows\System\JwKrCzj.exe
  C:\Windows\System\JwKrCzj.exe
  2⤵
  PID:8240
- C:\Windows\System\muqRCjs.exe
  C:\Windows\System\muqRCjs.exe
  2⤵
  PID:8256
- C:\Windows\System\iVDfLNR.exe
  C:\Windows\System\iVDfLNR.exe
  2⤵
  PID:8276
- C:\Windows\System\DcRbQHp.exe
  C:\Windows\System\DcRbQHp.exe
  2⤵
  PID:8300
- C:\Windows\System\TWwWTow.exe
  C:\Windows\System\TWwWTow.exe
  2⤵
  PID:8328
- C:\Windows\System\yItTSGl.exe
  C:\Windows\System\yItTSGl.exe
  2⤵
  PID:8352
- C:\Windows\System\pYqhJBP.exe
  C:\Windows\System\pYqhJBP.exe
  2⤵
  PID:8376
- C:\Windows\System\ODILQdZ.exe
  C:\Windows\System\ODILQdZ.exe
  2⤵
  PID:8412
- C:\Windows\System\PQASorR.exe
  C:\Windows\System\PQASorR.exe
  2⤵
  PID:8456
- C:\Windows\System\GtxzVvy.exe
  C:\Windows\System\GtxzVvy.exe
  2⤵
  PID:8492
- C:\Windows\System\TanEBZv.exe
  C:\Windows\System\TanEBZv.exe
  2⤵
  PID:8516
- C:\Windows\System\zrUKwpv.exe
  C:\Windows\System\zrUKwpv.exe
  2⤵
  PID:8532
- C:\Windows\System\PxdSNUa.exe
  C:\Windows\System\PxdSNUa.exe
  2⤵
  PID:8548
- C:\Windows\System\NajHJJQ.exe
  C:\Windows\System\NajHJJQ.exe
  2⤵
  PID:8564
- C:\Windows\System\ZZgvZys.exe
  C:\Windows\System\ZZgvZys.exe
  2⤵
  PID:8584
- C:\Windows\System\LEjDRFU.exe
  C:\Windows\System\LEjDRFU.exe
  2⤵
  PID:8608
- C:\Windows\System\vQuekvl.exe
  C:\Windows\System\vQuekvl.exe
  2⤵
  PID:8640
- C:\Windows\System\PKfmUiA.exe
  C:\Windows\System\PKfmUiA.exe
  2⤵
  PID:8660
- C:\Windows\System\XwkucZk.exe
  C:\Windows\System\XwkucZk.exe
  2⤵
  PID:8680
- C:\Windows\System\opxsvux.exe
  C:\Windows\System\opxsvux.exe
  2⤵
  PID:8708
- C:\Windows\System\dTAVGGb.exe
  C:\Windows\System\dTAVGGb.exe
  2⤵
  PID:8724
- C:\Windows\System\WKTyOAH.exe
  C:\Windows\System\WKTyOAH.exe
  2⤵
  PID:8744
- C:\Windows\System\ZXtDpzb.exe
  C:\Windows\System\ZXtDpzb.exe
  2⤵
  PID:8768
- C:\Windows\System\gNUfKWq.exe
  C:\Windows\System\gNUfKWq.exe
  2⤵
  PID:8792
- C:\Windows\System\tfPxgik.exe
  C:\Windows\System\tfPxgik.exe
  2⤵
  PID:8808
- C:\Windows\System\RMiygBF.exe
  C:\Windows\System\RMiygBF.exe
  2⤵
  PID:8832
- C:\Windows\System\HiwKOhb.exe
  C:\Windows\System\HiwKOhb.exe
  2⤵
  PID:8852
- C:\Windows\System\ABjBbiD.exe
  C:\Windows\System\ABjBbiD.exe
  2⤵
  PID:8872
- C:\Windows\System\XdWaRcr.exe
  C:\Windows\System\XdWaRcr.exe
  2⤵
  PID:8888
- C:\Windows\System\TkeBoOS.exe
  C:\Windows\System\TkeBoOS.exe
  2⤵
  PID:8908
- C:\Windows\System\qTbmrar.exe
  C:\Windows\System\qTbmrar.exe
  2⤵
  PID:8928
- C:\Windows\System\eYDDQTq.exe
  C:\Windows\System\eYDDQTq.exe
  2⤵
  PID:8956
- C:\Windows\System\SZAhxQc.exe
  C:\Windows\System\SZAhxQc.exe
  2⤵
  PID:8976
- C:\Windows\System\hIxpjgY.exe
  C:\Windows\System\hIxpjgY.exe
  2⤵
  PID:8992
- C:\Windows\System\hKcWBTi.exe
  C:\Windows\System\hKcWBTi.exe
  2⤵
  PID:9012
- C:\Windows\System\YsOYasj.exe
  C:\Windows\System\YsOYasj.exe
  2⤵
  PID:9044
- C:\Windows\System\pOnVVVw.exe
  C:\Windows\System\pOnVVVw.exe
  2⤵
  PID:9064
- C:\Windows\System\JWcqhtP.exe
  C:\Windows\System\JWcqhtP.exe
  2⤵
  PID:9084
- C:\Windows\System\MxFhilb.exe
  C:\Windows\System\MxFhilb.exe
  2⤵
  PID:9100
- C:\Windows\System\FrhxGBg.exe
  C:\Windows\System\FrhxGBg.exe
  2⤵
  PID:9120
- C:\Windows\System\issktvg.exe
  C:\Windows\System\issktvg.exe
  2⤵
  PID:9140
- C:\Windows\System\QRZEJkC.exe
  C:\Windows\System\QRZEJkC.exe
  2⤵
  PID:9156
- C:\Windows\System\EeFXXom.exe
  C:\Windows\System\EeFXXom.exe
  2⤵
  PID:9180
- C:\Windows\System\jRlbpzK.exe
  C:\Windows\System\jRlbpzK.exe
  2⤵
  PID:9200
- C:\Windows\System\TWLTqvE.exe
  C:\Windows\System\TWLTqvE.exe
  2⤵
  PID:7068
- C:\Windows\System\LymQpQn.exe
  C:\Windows\System\LymQpQn.exe
  2⤵
  PID:7788
- C:\Windows\System\ztnravt.exe
  C:\Windows\System\ztnravt.exe
  2⤵
  PID:7300
- C:\Windows\System\EiXkpRE.exe
  C:\Windows\System\EiXkpRE.exe
  2⤵
  PID:7340
- C:\Windows\System\YesZavD.exe
  C:\Windows\System\YesZavD.exe
  2⤵
  PID:7384
- C:\Windows\System\xfizerA.exe
  C:\Windows\System\xfizerA.exe
  2⤵
  PID:8076
- C:\Windows\System\sKQRyGI.exe
  C:\Windows\System\sKQRyGI.exe
  2⤵
  PID:6952
- C:\Windows\System\oyAJoJC.exe
  C:\Windows\System\oyAJoJC.exe
  2⤵
  PID:7600
- C:\Windows\System\gVwwqOI.exe
  C:\Windows\System\gVwwqOI.exe
  2⤵
  PID:8200
- C:\Windows\System\CWZCjLx.exe
  C:\Windows\System\CWZCjLx.exe
  2⤵
  PID:7176
- C:\Windows\System\yEgbFUM.exe
  C:\Windows\System\yEgbFUM.exe
  2⤵
  PID:7780
- C:\Windows\System\UxGxQgW.exe
  C:\Windows\System\UxGxQgW.exe
  2⤵
  PID:7252
- C:\Windows\System\mEOHcHT.exe
  C:\Windows\System\mEOHcHT.exe
  2⤵
  PID:7848
- C:\Windows\System\phPHZkB.exe
  C:\Windows\System\phPHZkB.exe
  2⤵
  PID:7288
- C:\Windows\System\eaviYNE.exe
  C:\Windows\System\eaviYNE.exe
  2⤵
  PID:8020
- C:\Windows\System\fFClKnD.exe
  C:\Windows\System\fFClKnD.exe
  2⤵
  PID:8344
- C:\Windows\System\WRYcUjV.exe
  C:\Windows\System\WRYcUjV.exe
  2⤵
  PID:8140
- C:\Windows\System\oOzABRH.exe
  C:\Windows\System\oOzABRH.exe
  2⤵
  PID:8368
- C:\Windows\System\CaQiRAx.exe
  C:\Windows\System\CaQiRAx.exe
  2⤵
  PID:7632
- C:\Windows\System\KnuDNEp.exe
  C:\Windows\System\KnuDNEp.exe
  2⤵
  PID:6400
- C:\Windows\System\NmWKrAH.exe
  C:\Windows\System\NmWKrAH.exe
  2⤵
  PID:7596
- C:\Windows\System\YMwVXra.exe
  C:\Windows\System\YMwVXra.exe
  2⤵
  PID:8484
- C:\Windows\System\PxCbaKw.exe
  C:\Windows\System\PxCbaKw.exe
  2⤵
  PID:7024
- C:\Windows\System\XFjdQgm.exe
  C:\Windows\System\XFjdQgm.exe
  2⤵
  PID:7832
- C:\Windows\System\SKZeWFA.exe
  C:\Windows\System\SKZeWFA.exe
  2⤵
  PID:8716
- C:\Windows\System\zMmJSPi.exe
  C:\Windows\System\zMmJSPi.exe
  2⤵
  PID:8816
- C:\Windows\System\aBYtcWT.exe
  C:\Windows\System\aBYtcWT.exe
  2⤵
  PID:9224
- C:\Windows\System\yrUwOUB.exe
  C:\Windows\System\yrUwOUB.exe
  2⤵
  PID:9248
- C:\Windows\System\pOgXmyN.exe
  C:\Windows\System\pOgXmyN.exe
  2⤵
  PID:9264
- C:\Windows\System\dhbEuGb.exe
  C:\Windows\System\dhbEuGb.exe
  2⤵
  PID:9284
- C:\Windows\System\bpdHvbZ.exe
  C:\Windows\System\bpdHvbZ.exe
  2⤵
  PID:9308
- C:\Windows\System\puErxGE.exe
  C:\Windows\System\puErxGE.exe
  2⤵
  PID:9328
- C:\Windows\System\HtOermq.exe
  C:\Windows\System\HtOermq.exe
  2⤵
  PID:9356
- C:\Windows\System\YeempTn.exe
  C:\Windows\System\YeempTn.exe
  2⤵
  PID:9376
- C:\Windows\System\BbtpUpo.exe
  C:\Windows\System\BbtpUpo.exe
  2⤵
  PID:9396
- C:\Windows\System\iootbqV.exe
  C:\Windows\System\iootbqV.exe
  2⤵
  PID:9424
- C:\Windows\System\uHXiKnv.exe
  C:\Windows\System\uHXiKnv.exe
  2⤵
  PID:9444
- C:\Windows\System\ocTOdQz.exe
  C:\Windows\System\ocTOdQz.exe
  2⤵
  PID:9460
- C:\Windows\System\WNSMWKj.exe
  C:\Windows\System\WNSMWKj.exe
  2⤵
  PID:9476
- C:\Windows\System\BlCVWZO.exe
  C:\Windows\System\BlCVWZO.exe
  2⤵
  PID:9492
- C:\Windows\System\zKqkwYc.exe
  C:\Windows\System\zKqkwYc.exe
  2⤵
  PID:9512
- C:\Windows\System\DgkxKxS.exe
  C:\Windows\System\DgkxKxS.exe
  2⤵
  PID:9552
- C:\Windows\System\reQZhhu.exe
  C:\Windows\System\reQZhhu.exe
  2⤵
  PID:9580
- C:\Windows\System\EcdhBfE.exe
  C:\Windows\System\EcdhBfE.exe
  2⤵
  PID:9612
- C:\Windows\System\coAlHti.exe
  C:\Windows\System\coAlHti.exe
  2⤵
  PID:9632
- C:\Windows\System\YQPRdXa.exe
  C:\Windows\System\YQPRdXa.exe
  2⤵
  PID:9656
- C:\Windows\System\dBcFKCE.exe
  C:\Windows\System\dBcFKCE.exe
  2⤵
  PID:9680
- C:\Windows\System\SeChxXB.exe
  C:\Windows\System\SeChxXB.exe
  2⤵
  PID:9712
- C:\Windows\System\XtlOocd.exe
  C:\Windows\System\XtlOocd.exe
  2⤵
  PID:9736
- C:\Windows\System\OeLqxxY.exe
  C:\Windows\System\OeLqxxY.exe
  2⤵
  PID:9768
- C:\Windows\System\ZuJqLsc.exe
  C:\Windows\System\ZuJqLsc.exe
  2⤵
  PID:9784
- C:\Windows\System\oTsxNlA.exe
  C:\Windows\System\oTsxNlA.exe
  2⤵
  PID:9808
- C:\Windows\System\DzhgcaZ.exe
  C:\Windows\System\DzhgcaZ.exe
  2⤵
  PID:9836
- C:\Windows\System\NnYXraU.exe
  C:\Windows\System\NnYXraU.exe
  2⤵
  PID:9876
- C:\Windows\System\LPsrgWL.exe
  C:\Windows\System\LPsrgWL.exe
  2⤵
  PID:9892
- C:\Windows\System\sJnGpPq.exe
  C:\Windows\System\sJnGpPq.exe
  2⤵
  PID:9912
- C:\Windows\System\khLQJSw.exe
  C:\Windows\System\khLQJSw.exe
  2⤵
  PID:9936
- C:\Windows\System\LWYkvcB.exe
  C:\Windows\System\LWYkvcB.exe
  2⤵
  PID:9964
- C:\Windows\System\VlhMsxP.exe
  C:\Windows\System\VlhMsxP.exe
  2⤵
  PID:9984
- C:\Windows\System\Xbpcjuq.exe
  C:\Windows\System\Xbpcjuq.exe
  2⤵
  PID:10012
- C:\Windows\System\stVcPsi.exe
  C:\Windows\System\stVcPsi.exe
  2⤵
  PID:10036
- C:\Windows\System\mAytvnP.exe
  C:\Windows\System\mAytvnP.exe
  2⤵
  PID:10056
- C:\Windows\System\JQlBeqg.exe
  C:\Windows\System\JQlBeqg.exe
  2⤵
  PID:10076
- C:\Windows\System\QOTnrix.exe
  C:\Windows\System\QOTnrix.exe
  2⤵
  PID:10104
- C:\Windows\System\OnlRvrq.exe
  C:\Windows\System\OnlRvrq.exe
  2⤵
  PID:10128
- C:\Windows\System\tbfGehx.exe
  C:\Windows\System\tbfGehx.exe
  2⤵
  PID:10148
- C:\Windows\System\YPAGEHd.exe
  C:\Windows\System\YPAGEHd.exe
  2⤵
  PID:10172
- C:\Windows\System\nWqWFeN.exe
  C:\Windows\System\nWqWFeN.exe
  2⤵
  PID:10200
- C:\Windows\System\lVxOKYl.exe
  C:\Windows\System\lVxOKYl.exe
  2⤵
  PID:10220
- C:\Windows\System\ROmlnDl.exe
  C:\Windows\System\ROmlnDl.exe
  2⤵
  PID:10236
- C:\Windows\System\BVPIcyZ.exe
  C:\Windows\System\BVPIcyZ.exe
  2⤵
  PID:8880
- C:\Windows\System\aixzRlg.exe
  C:\Windows\System\aixzRlg.exe
  2⤵
  PID:8920
- C:\Windows\System\OadbWQx.exe
  C:\Windows\System\OadbWQx.exe
  2⤵
  PID:8984
- C:\Windows\System\kjGCyhN.exe
  C:\Windows\System\kjGCyhN.exe
  2⤵
  PID:9052
- C:\Windows\System\LyZMJQl.exe
  C:\Windows\System\LyZMJQl.exe
  2⤵
  PID:9096
- C:\Windows\System\LlgTBbW.exe
  C:\Windows\System\LlgTBbW.exe
  2⤵
  PID:8672
- C:\Windows\System\oehaQNA.exe
  C:\Windows\System\oehaQNA.exe
  2⤵
  PID:8700
- C:\Windows\System\tlaFIGW.exe
  C:\Windows\System\tlaFIGW.exe
  2⤵
  PID:8760
- C:\Windows\System\UMiZJBZ.exe
  C:\Windows\System\UMiZJBZ.exe
  2⤵
  PID:9324
- C:\Windows\System\hYyTonJ.exe
  C:\Windows\System\hYyTonJ.exe
  2⤵
  PID:8968
- C:\Windows\System\pmERilp.exe
  C:\Windows\System\pmERilp.exe
  2⤵
  PID:9076
- C:\Windows\System\ndaAvWg.exe
  C:\Windows\System\ndaAvWg.exe
  2⤵
  PID:7164
- C:\Windows\System\PxSuniT.exe
  C:\Windows\System\PxSuniT.exe
  2⤵
  PID:9792
- C:\Windows\System\IRdQUrn.exe
  C:\Windows\System\IRdQUrn.exe
  2⤵
  PID:10032
- C:\Windows\System\vUnXVno.exe
  C:\Windows\System\vUnXVno.exe
  2⤵
  PID:8116
- C:\Windows\System\mBIYHzP.exe
  C:\Windows\System\mBIYHzP.exe
  2⤵
  PID:9004
- C:\Windows\System\rjCmNYb.exe
  C:\Windows\System\rjCmNYb.exe
  2⤵
  PID:8804
- C:\Windows\System\xCErugp.exe
  C:\Windows\System\xCErugp.exe
  2⤵
  PID:8844
- C:\Windows\System\JdcVrqc.exe
  C:\Windows\System\JdcVrqc.exe
  2⤵
  PID:8320
- C:\Windows\System\ydOwkDl.exe
  C:\Windows\System\ydOwkDl.exe
  2⤵
  PID:9608
- C:\Windows\System\VnJyXld.exe
  C:\Windows\System\VnJyXld.exe
  2⤵
  PID:9756
- C:\Windows\System\mQNIuTt.exe
  C:\Windows\System\mQNIuTt.exe
  2⤵
  PID:9884
- C:\Windows\System\utjaEuq.exe
  C:\Windows\System\utjaEuq.exe
  2⤵
  PID:9976
- C:\Windows\System\UXWFFdU.exe
  C:\Windows\System\UXWFFdU.exe
  2⤵
  PID:10024
- C:\Windows\System\pKRpYUf.exe
  C:\Windows\System\pKRpYUf.exe
  2⤵
  PID:10092
- C:\Windows\System\xxJuLwm.exe
  C:\Windows\System\xxJuLwm.exe
  2⤵
  PID:10164
- C:\Windows\System\QTxazYu.exe
  C:\Windows\System\QTxazYu.exe
  2⤵
  PID:10196
- C:\Windows\System\duoOaPU.exe
  C:\Windows\System\duoOaPU.exe
  2⤵
  PID:10256
- C:\Windows\System\vVZZMhl.exe
  C:\Windows\System\vVZZMhl.exe
  2⤵
  PID:10276
- C:\Windows\System\JfWTHEG.exe
  C:\Windows\System\JfWTHEG.exe
  2⤵
  PID:10296
- C:\Windows\System\EiMkgOe.exe
  C:\Windows\System\EiMkgOe.exe
  2⤵
  PID:10320
- C:\Windows\System\LMcdqWT.exe
  C:\Windows\System\LMcdqWT.exe
  2⤵
  PID:10348
- C:\Windows\System\NJesLAF.exe
  C:\Windows\System\NJesLAF.exe
  2⤵
  PID:10364
- C:\Windows\System\RxCbJGM.exe
  C:\Windows\System\RxCbJGM.exe
  2⤵
  PID:10392
- C:\Windows\System\VTKJteE.exe
  C:\Windows\System\VTKJteE.exe
  2⤵
  PID:10412
- C:\Windows\System\CtWRgJu.exe
  C:\Windows\System\CtWRgJu.exe
  2⤵
  PID:10444
- C:\Windows\System\LarwCku.exe
  C:\Windows\System\LarwCku.exe
  2⤵
  PID:10464
- C:\Windows\System\VhHxdkh.exe
  C:\Windows\System\VhHxdkh.exe
  2⤵
  PID:10480
- C:\Windows\System\poWSvGi.exe
  C:\Windows\System\poWSvGi.exe
  2⤵
  PID:10500
- C:\Windows\System\FvlniVh.exe
  C:\Windows\System\FvlniVh.exe
  2⤵
  PID:10520
- C:\Windows\System\rnKYdHc.exe
  C:\Windows\System\rnKYdHc.exe
  2⤵
  PID:10540
- C:\Windows\System\zrgeAuy.exe
  C:\Windows\System\zrgeAuy.exe
  2⤵
  PID:10564
- C:\Windows\System\AvxVZkz.exe
  C:\Windows\System\AvxVZkz.exe
  2⤵
  PID:10584
- C:\Windows\System\IQPxXSr.exe
  C:\Windows\System\IQPxXSr.exe
  2⤵
  PID:10604
- C:\Windows\System\TRODTIj.exe
  C:\Windows\System\TRODTIj.exe
  2⤵
  PID:10624
- C:\Windows\System\mcypSIy.exe
  C:\Windows\System\mcypSIy.exe
  2⤵
  PID:10640
- C:\Windows\System\uhIBcaA.exe
  C:\Windows\System\uhIBcaA.exe
  2⤵
  PID:10768
- C:\Windows\System\eNhUepn.exe
  C:\Windows\System\eNhUepn.exe
  2⤵
  PID:10804
- C:\Windows\System\DCdvWOP.exe
  C:\Windows\System\DCdvWOP.exe
  2⤵
  PID:7660
- C:\Windows\System\QPxpNfZ.exe
  C:\Windows\System\QPxpNfZ.exe
  2⤵
  PID:10980
- C:\Windows\System\MKdvwng.exe
  C:\Windows\System\MKdvwng.exe
  2⤵
  PID:9648
- C:\Windows\System\QbokjxI.exe
  C:\Windows\System\QbokjxI.exe
  2⤵
  PID:11216
- C:\Windows\System\EBscQDo.exe
  C:\Windows\System\EBscQDo.exe
  2⤵
  PID:7744
- C:\Windows\System\SuPGWgX.exe
  C:\Windows\System\SuPGWgX.exe
  2⤵
  PID:10636
- C:\Windows\System\sdWJKsu.exe
  C:\Windows\System\sdWJKsu.exe
  2⤵
  PID:8232
- C:\Windows\System\ORIhTZU.exe
  C:\Windows\System\ORIhTZU.exe
  2⤵
  PID:10968
- C:\Windows\System\iIMihna.exe
  C:\Windows\System\iIMihna.exe
  2⤵
  PID:9956
- C:\Windows\System\gotUREK.exe
  C:\Windows\System\gotUREK.exe
  2⤵
  PID:6224
- C:\Windows\System\ByptrrM.exe
  C:\Windows\System\ByptrrM.exe
  2⤵
  PID:10284
- C:\Windows\System\VVHgnwN.exe
  C:\Windows\System\VVHgnwN.exe
  2⤵
  PID:1544
- C:\Windows\System\XRkCKQk.exe
  C:\Windows\System\XRkCKQk.exe
  2⤵
  PID:10600
- C:\Windows\System\GLfkbMt.exe
  C:\Windows\System\GLfkbMt.exe
  2⤵
  PID:10576
- C:\Windows\System\AdComIt.exe
  C:\Windows\System\AdComIt.exe
  2⤵
  PID:9688
- C:\Windows\System\enVhrIa.exe
  C:\Windows\System\enVhrIa.exe
  2⤵
  PID:9112
- C:\Windows\System\iJMKsVd.exe
  C:\Windows\System\iJMKsVd.exe
  2⤵
  PID:10632
- C:\Windows\System\kixxTbT.exe
  C:\Windows\System\kixxTbT.exe
  2⤵
  PID:9276
- C:\Windows\System\RLHEwuS.exe
  C:\Windows\System\RLHEwuS.exe
  2⤵
  PID:10860
- C:\Windows\System\hxXWaRR.exe
  C:\Windows\System\hxXWaRR.exe
  2⤵
  PID:9972
- C:\Windows\System\DwuiiPF.exe
  C:\Windows\System\DwuiiPF.exe
  2⤵
  PID:11284
- C:\Windows\System\mAjVNXt.exe
  C:\Windows\System\mAjVNXt.exe
  2⤵
  PID:11312
- C:\Windows\System\EFplsZi.exe
  C:\Windows\System\EFplsZi.exe
  2⤵
  PID:11332
- C:\Windows\System\CqrWyQh.exe
  C:\Windows\System\CqrWyQh.exe
  2⤵
  PID:11356
- C:\Windows\System\bZLbZyt.exe
  C:\Windows\System\bZLbZyt.exe
  2⤵
  PID:11376
- C:\Windows\System\ZLyGPdI.exe
  C:\Windows\System\ZLyGPdI.exe
  2⤵
  PID:11396
- C:\Windows\System\cNZGOXA.exe
  C:\Windows\System\cNZGOXA.exe
  2⤵
  PID:11416
- C:\Windows\System\sZoRKCG.exe
  C:\Windows\System\sZoRKCG.exe
  2⤵
  PID:11432
- C:\Windows\System\iYnMOnT.exe
  C:\Windows\System\iYnMOnT.exe
  2⤵
  PID:11452
- C:\Windows\System\upuweNs.exe
  C:\Windows\System\upuweNs.exe
  2⤵
  PID:11476
- C:\Windows\System\siKQzMz.exe
  C:\Windows\System\siKQzMz.exe
  2⤵
  PID:11496
- C:\Windows\System\tHeeNnE.exe
  C:\Windows\System\tHeeNnE.exe
  2⤵
  PID:11524
- C:\Windows\System\ZjVnShd.exe
  C:\Windows\System\ZjVnShd.exe
  2⤵
  PID:11544
- C:\Windows\System\dgBvwli.exe
  C:\Windows\System\dgBvwli.exe
  2⤵
  PID:11568
- C:\Windows\System\tZFrrrf.exe
  C:\Windows\System\tZFrrrf.exe
  2⤵
  PID:11584
- C:\Windows\System\xBmwqhR.exe
  C:\Windows\System\xBmwqhR.exe
  2⤵
  PID:11600
- C:\Windows\System\PhOQLKB.exe
  C:\Windows\System\PhOQLKB.exe
  2⤵
  PID:11688
- C:\Windows\System\gMjEtjE.exe
  C:\Windows\System\gMjEtjE.exe
  2⤵
  PID:11708
- C:\Windows\System\ZXWesBU.exe
  C:\Windows\System\ZXWesBU.exe
  2⤵
  PID:11728
- C:\Windows\System\IPfVKQR.exe
  C:\Windows\System\IPfVKQR.exe
  2⤵
  PID:11744
- C:\Windows\System\ydGOMCo.exe
  C:\Windows\System\ydGOMCo.exe
  2⤵
  PID:11768
- C:\Windows\System\QtNZptG.exe
  C:\Windows\System\QtNZptG.exe
  2⤵
  PID:11800
- C:\Windows\System\JUWUfTe.exe
  C:\Windows\System\JUWUfTe.exe
  2⤵
  PID:11836
- C:\Windows\System\RmaEcpv.exe
  C:\Windows\System\RmaEcpv.exe
  2⤵
  PID:11860
- C:\Windows\System\krtttbx.exe
  C:\Windows\System\krtttbx.exe
  2⤵
  PID:11880
- C:\Windows\System\krBobGf.exe
  C:\Windows\System\krBobGf.exe
  2⤵
  PID:11904
- C:\Windows\System\IRFqmym.exe
  C:\Windows\System\IRFqmym.exe
  2⤵
  PID:11920
- C:\Windows\System\SyDTdMx.exe
  C:\Windows\System\SyDTdMx.exe
  2⤵
  PID:11944
- C:\Windows\System\gngYDVD.exe
  C:\Windows\System\gngYDVD.exe
  2⤵
  PID:11960
- C:\Windows\System\PSeKltg.exe
  C:\Windows\System\PSeKltg.exe
  2⤵
  PID:11980
- C:\Windows\System\taDGEUV.exe
  C:\Windows\System\taDGEUV.exe
  2⤵
  PID:12008
- C:\Windows\System\gvCSyqz.exe
  C:\Windows\System\gvCSyqz.exe
  2⤵
  PID:12028
- C:\Windows\System\iqydbhJ.exe
  C:\Windows\System\iqydbhJ.exe
  2⤵
  PID:12048
- C:\Windows\System\GcnohWq.exe
  C:\Windows\System\GcnohWq.exe
  2⤵
  PID:12136
- C:\Windows\System\FdaIXlT.exe
  C:\Windows\System\FdaIXlT.exe
  2⤵
  PID:12188
- C:\Windows\System\qngHxfR.exe
  C:\Windows\System\qngHxfR.exe
  2⤵
  PID:12204
- C:\Windows\System\afOaaPE.exe
  C:\Windows\System\afOaaPE.exe
  2⤵
  PID:12232
- C:\Windows\System\esCEHDQ.exe
  C:\Windows\System\esCEHDQ.exe
  2⤵
  PID:12252
- C:\Windows\System\lPsbxRx.exe
  C:\Windows\System\lPsbxRx.exe
  2⤵
  PID:6996
- C:\Windows\System\BRjoGYo.exe
  C:\Windows\System\BRjoGYo.exe
  2⤵
  PID:11516
- C:\Windows\System\gEbRQyo.exe
  C:\Windows\System\gEbRQyo.exe
  2⤵
  PID:11576
- C:\Windows\System\pPOJFLL.exe
  C:\Windows\System\pPOJFLL.exe
  2⤵
  PID:11388
- C:\Windows\System\grYPRIA.exe
  C:\Windows\System\grYPRIA.exe
  2⤵
  PID:10272
- C:\Windows\System\nkvMQfu.exe
  C:\Windows\System\nkvMQfu.exe
  2⤵
  PID:11304
- C:\Windows\System\yrwvWlj.exe
  C:\Windows\System\yrwvWlj.exe
  2⤵
  PID:11328
- C:\Windows\System\WAKtpGr.exe
  C:\Windows\System\WAKtpGr.exe
  2⤵
  PID:11760
- C:\Windows\System\IqdpVoH.exe
  C:\Windows\System\IqdpVoH.exe
  2⤵
  PID:11644
- C:\Windows\System\wLUUDzt.exe
  C:\Windows\System\wLUUDzt.exe
  2⤵
  PID:11492
- C:\Windows\System\dtisYPy.exe
  C:\Windows\System\dtisYPy.exe
  2⤵
  PID:11892
- C:\Windows\System\aryPQZA.exe
  C:\Windows\System\aryPQZA.exe
  2⤵
  PID:11952
- C:\Windows\System\uWfoGlY.exe
  C:\Windows\System\uWfoGlY.exe
  2⤵
  PID:8
- C:\Windows\System\CUYVuQI.exe
  C:\Windows\System\CUYVuQI.exe
  2⤵
  PID:12000
- C:\Windows\System\ZKsbONX.exe
  C:\Windows\System\ZKsbONX.exe
  2⤵
  PID:6592
- C:\Windows\System\mJDSnrY.exe
  C:\Windows\System\mJDSnrY.exe
  2⤵
  PID:11764
- C:\Windows\System\coTVKDh.exe
  C:\Windows\System\coTVKDh.exe
  2⤵
  PID:12088
- C:\Windows\System\AvbURqS.exe
  C:\Windows\System\AvbURqS.exe
  2⤵
  PID:12020
- C:\Windows\System\xAwHNXs.exe
  C:\Windows\System\xAwHNXs.exe
  2⤵
  PID:2452
- C:\Windows\System\mbRMvuW.exe
  C:\Windows\System\mbRMvuW.exe
  2⤵
  PID:12044
- C:\Windows\System\dEmzDdu.exe
  C:\Windows\System\dEmzDdu.exe
  2⤵
  PID:12092
- C:\Windows\System\feMxREb.exe
  C:\Windows\System\feMxREb.exe
  2⤵
  PID:12272
- C:\Windows\System\IguzzNF.exe
  C:\Windows\System\IguzzNF.exe
  2⤵
  PID:12296
- C:\Windows\System\XfdFlEo.exe
  C:\Windows\System\XfdFlEo.exe
  2⤵
  PID:12328
- C:\Windows\System\MxDFRsS.exe
  C:\Windows\System\MxDFRsS.exe
  2⤵
  PID:12344
- C:\Windows\System\cmIYPfg.exe
  C:\Windows\System\cmIYPfg.exe
  2⤵
  PID:12364
- C:\Windows\System\ByHZvTO.exe
  C:\Windows\System\ByHZvTO.exe
  2⤵
  PID:12388
- C:\Windows\System\KcIiUuM.exe
  C:\Windows\System\KcIiUuM.exe
  2⤵
  PID:12404
- C:\Windows\System\QfTCZXq.exe
  C:\Windows\System\QfTCZXq.exe
  2⤵
  PID:12424
- C:\Windows\System\TGVqjOA.exe
  C:\Windows\System\TGVqjOA.exe
  2⤵
  PID:12448
- C:\Windows\System\yEOocnp.exe
  C:\Windows\System\yEOocnp.exe
  2⤵
  PID:12468
- C:\Windows\System\QiqXPdl.exe
  C:\Windows\System\QiqXPdl.exe
  2⤵
  PID:12488
- C:\Windows\System\kuExSBU.exe
  C:\Windows\System\kuExSBU.exe
  2⤵
  PID:12504
- C:\Windows\System\QRlPhgq.exe
  C:\Windows\System\QRlPhgq.exe
  2⤵
  PID:12524
- C:\Windows\System\oEnqNCU.exe
  C:\Windows\System\oEnqNCU.exe
  2⤵
  PID:12544
- C:\Windows\System\ZnJzukC.exe
  C:\Windows\System\ZnJzukC.exe
  2⤵
  PID:12564
- C:\Windows\System\LcOeGrc.exe
  C:\Windows\System\LcOeGrc.exe
  2⤵
  PID:12584
- C:\Windows\System\BAtUGUY.exe
  C:\Windows\System\BAtUGUY.exe
  2⤵
  PID:12600
- C:\Windows\System\bhsktrq.exe
  C:\Windows\System\bhsktrq.exe
  2⤵
  PID:12616
- C:\Windows\System\RhyQGho.exe
  C:\Windows\System\RhyQGho.exe
  2⤵
  PID:12632
- C:\Windows\System\qsMkdwe.exe
  C:\Windows\System\qsMkdwe.exe
  2⤵
  PID:12648
- C:\Windows\System\WyKdoZf.exe
  C:\Windows\System\WyKdoZf.exe
  2⤵
  PID:12668
- C:\Windows\System\cnmQLJv.exe
  C:\Windows\System\cnmQLJv.exe
  2⤵
  PID:12684
- C:\Windows\System\qGYfeuP.exe
  C:\Windows\System\qGYfeuP.exe
  2⤵
  PID:12700
- C:\Windows\System\baFvgqN.exe
  C:\Windows\System\baFvgqN.exe
  2⤵
  PID:12720
- C:\Windows\System\MBugSnd.exe
  C:\Windows\System\MBugSnd.exe
  2⤵
  PID:12740
- C:\Windows\System\VmZiukp.exe
  C:\Windows\System\VmZiukp.exe
  2⤵
  PID:12764
- C:\Windows\System\RcAycsb.exe
  C:\Windows\System\RcAycsb.exe
  2⤵
  PID:12784
- C:\Windows\System\njkFllh.exe
  C:\Windows\System\njkFllh.exe
  2⤵
  PID:12800
- C:\Windows\System\zpAeCWH.exe
  C:\Windows\System\zpAeCWH.exe
  2⤵
  PID:12816
- C:\Windows\System\jeZzCAN.exe
  C:\Windows\System\jeZzCAN.exe
  2⤵
  PID:12832
- C:\Windows\System\pSecInj.exe
  C:\Windows\System\pSecInj.exe
  2⤵
  PID:12852
- C:\Windows\System\PBNaxBR.exe
  C:\Windows\System\PBNaxBR.exe
  2⤵
  PID:12872
- C:\Windows\System\ynMMrjw.exe
  C:\Windows\System\ynMMrjw.exe
  2⤵
  PID:12896
- C:\Windows\System\VKvfpnV.exe
  C:\Windows\System\VKvfpnV.exe
  2⤵
  PID:12912
- C:\Windows\System\ASyOCme.exe
  C:\Windows\System\ASyOCme.exe
  2⤵
  PID:12932
- C:\Windows\System\cfybeiB.exe
  C:\Windows\System\cfybeiB.exe
  2⤵
  PID:12952
- C:\Windows\System\ZcHModq.exe
  C:\Windows\System\ZcHModq.exe
  2⤵
  PID:12972
- C:\Windows\System\vmgGwJg.exe
  C:\Windows\System\vmgGwJg.exe
  2⤵
  PID:12992
- C:\Windows\System\AixLLwT.exe
  C:\Windows\System\AixLLwT.exe
  2⤵
  PID:13008
- C:\Windows\System\URjXJed.exe
  C:\Windows\System\URjXJed.exe
  2⤵
  PID:13024
- C:\Windows\System\fOhHDJE.exe
  C:\Windows\System\fOhHDJE.exe
  2⤵
  PID:13048
- C:\Windows\System\KoLjSEQ.exe
  C:\Windows\System\KoLjSEQ.exe
  2⤵
  PID:13064
- C:\Windows\System\ARvTryb.exe
  C:\Windows\System\ARvTryb.exe
  2⤵
  PID:13080
- C:\Windows\System\HZbkQNe.exe
  C:\Windows\System\HZbkQNe.exe
  2⤵
  PID:13100
- C:\Windows\System\QjrBuVH.exe
  C:\Windows\System\QjrBuVH.exe
  2⤵
  PID:13120
- C:\Windows\System\HTrwFmi.exe
  C:\Windows\System\HTrwFmi.exe
  2⤵
  PID:13144
- C:\Windows\System\oNkTWVg.exe
  C:\Windows\System\oNkTWVg.exe
  2⤵
  PID:13160
- C:\Windows\System\puXanox.exe
  C:\Windows\System\puXanox.exe
  2⤵
  PID:13184
- C:\Windows\System\FibPMNk.exe
  C:\Windows\System\FibPMNk.exe
  2⤵
  PID:13208
- C:\Windows\System\PqdVhFn.exe
  C:\Windows\System\PqdVhFn.exe
  2⤵
  PID:13228
- C:\Windows\System\WSXLGDO.exe
  C:\Windows\System\WSXLGDO.exe
  2⤵
  PID:13244
- C:\Windows\System\hAqCZxG.exe
  C:\Windows\System\hAqCZxG.exe
  2⤵
  PID:13264
- C:\Windows\System\ugTKUsk.exe
  C:\Windows\System\ugTKUsk.exe
  2⤵
  PID:12360
- C:\Windows\System\FtQGhVS.exe
  C:\Windows\System\FtQGhVS.exe
  2⤵
  PID:12384
- C:\Windows\System\OxzXtrB.exe
  C:\Windows\System\OxzXtrB.exe
  2⤵
  PID:11484
- C:\Windows\System\MfMPmxT.exe
  C:\Windows\System\MfMPmxT.exe
  2⤵
  PID:11740
- C:\Windows\System\TOCMXok.exe
  C:\Windows\System\TOCMXok.exe
  2⤵
  PID:11928
- C:\Windows\System\bbtGJrn.exe
  C:\Windows\System\bbtGJrn.exe
  2⤵
  PID:11680
- C:\Windows\System\eawuvpA.exe
  C:\Windows\System\eawuvpA.exe
  2⤵
  PID:12644
- C:\Windows\System\JkqobAy.exe
  C:\Windows\System\JkqobAy.exe
  2⤵
  PID:11368
- C:\Windows\System\OFuFwdp.exe
  C:\Windows\System\OFuFwdp.exe
  2⤵
  PID:11592
- C:\Windows\System\WOPdNpZ.exe
  C:\Windows\System\WOPdNpZ.exe
  2⤵
  PID:12880
- C:\Windows\System\DBBfirp.exe
  C:\Windows\System\DBBfirp.exe
  2⤵
  PID:11972
- C:\Windows\System\qzmTltl.exe
  C:\Windows\System\qzmTltl.exe
  2⤵
  PID:12964
- C:\Windows\System\tLiASIb.exe
  C:\Windows\System\tLiASIb.exe
  2⤵
  PID:12712
- C:\Windows\System\DFjntkM.exe
  C:\Windows\System\DFjntkM.exe
  2⤵
  PID:13220
- C:\Windows\System\pUFGUea.exe
  C:\Windows\System\pUFGUea.exe
  2⤵
  PID:12844
- C:\Windows\System\AldMAum.exe
  C:\Windows\System\AldMAum.exe
  2⤵
  PID:12512
- C:\Windows\System\WAQzUcE.exe
  C:\Windows\System\WAQzUcE.exe
  2⤵
  PID:12556
- C:\Windows\System\OYLVdCk.exe
  C:\Windows\System\OYLVdCk.exe
  2⤵
  PID:12940
- C:\Windows\System\uqauJCX.exe
  C:\Windows\System\uqauJCX.exe
  2⤵
  PID:13332
- C:\Windows\System\ZKZTGbA.exe
  C:\Windows\System\ZKZTGbA.exe
  2⤵
  PID:13352
- C:\Windows\System\doBSuQP.exe
  C:\Windows\System\doBSuQP.exe
  2⤵
  PID:13376
- C:\Windows\System\uhmpZMl.exe
  C:\Windows\System\uhmpZMl.exe
  2⤵
  PID:13412
- C:\Windows\System\NKZJovn.exe
  C:\Windows\System\NKZJovn.exe
  2⤵
  PID:13432
- C:\Windows\System\wlxUwYL.exe
  C:\Windows\System\wlxUwYL.exe
  2⤵
  PID:13456
- C:\Windows\System\GpnyRYT.exe
  C:\Windows\System\GpnyRYT.exe
  2⤵
  PID:13480
- C:\Windows\System\AngyJPv.exe
  C:\Windows\System\AngyJPv.exe
  2⤵
  PID:13500
- C:\Windows\System\dcaBxfC.exe
  C:\Windows\System\dcaBxfC.exe
  2⤵
  PID:13696
- C:\Windows\System\JrZCyMn.exe
  C:\Windows\System\JrZCyMn.exe
  2⤵
  PID:13728
- C:\Windows\System\RXisCMA.exe
  C:\Windows\System\RXisCMA.exe
  2⤵
  PID:13748
- C:\Windows\System\ymOlwEo.exe
  C:\Windows\System\ymOlwEo.exe
  2⤵
  PID:13772
- C:\Windows\System\TDXWBHo.exe
  C:\Windows\System\TDXWBHo.exe
  2⤵
  PID:13800
- C:\Windows\System\vJshutJ.exe
  C:\Windows\System\vJshutJ.exe
  2⤵
  PID:13824
- C:\Windows\System\NDNnnPG.exe
  C:\Windows\System\NDNnnPG.exe
  2⤵
  PID:13848
- C:\Windows\System\otuopma.exe
  C:\Windows\System\otuopma.exe
  2⤵
  PID:13872
- C:\Windows\System\MqydiKJ.exe
  C:\Windows\System\MqydiKJ.exe
  2⤵
  PID:13888
- C:\Windows\System\AMzdQYj.exe
  C:\Windows\System\AMzdQYj.exe
  2⤵
  PID:13908
- C:\Windows\System\lNvfduV.exe
  C:\Windows\System\lNvfduV.exe
  2⤵
  PID:13924
- C:\Windows\System\gRBpzWK.exe
  C:\Windows\System\gRBpzWK.exe
  2⤵
  PID:13940
- C:\Windows\System\xLzAHAi.exe
  C:\Windows\System\xLzAHAi.exe
  2⤵
  PID:13960
- C:\Windows\System\SUUGGIA.exe
  C:\Windows\System\SUUGGIA.exe
  2⤵
  PID:13980
- C:\Windows\System\JCBmNEZ.exe
  C:\Windows\System\JCBmNEZ.exe
  2⤵
  PID:14004
- C:\Windows\System\FUwyYrE.exe
  C:\Windows\System\FUwyYrE.exe
  2⤵
  PID:14024
- C:\Windows\System\FHVPtxS.exe
  C:\Windows\System\FHVPtxS.exe
  2⤵
  PID:14044
- C:\Windows\System\FsRvhqo.exe
  C:\Windows\System\FsRvhqo.exe
  2⤵
  PID:14068
- C:\Windows\System\iBykDNi.exe
  C:\Windows\System\iBykDNi.exe
  2⤵
  PID:14104
- C:\Windows\System\iEUteBu.exe
  C:\Windows\System\iEUteBu.exe
  2⤵
  PID:14124
- C:\Windows\System\AjOEXSh.exe
  C:\Windows\System\AjOEXSh.exe
  2⤵
  PID:14140
- C:\Windows\System\FqOWXJo.exe
  C:\Windows\System\FqOWXJo.exe
  2⤵
  PID:14156
- C:\Windows\System\kaLIMrX.exe
  C:\Windows\System\kaLIMrX.exe
  2⤵
  PID:14176
- C:\Windows\System\jiulSjW.exe
  C:\Windows\System\jiulSjW.exe
  2⤵
  PID:14192
- C:\Windows\System\TZogrlE.exe
  C:\Windows\System\TZogrlE.exe
  2⤵
  PID:14208
- C:\Windows\System\duTvSmm.exe
  C:\Windows\System\duTvSmm.exe
  2⤵
  PID:14224
- C:\Windows\System\pjAOPfj.exe
  C:\Windows\System\pjAOPfj.exe
  2⤵
  PID:14240
- C:\Windows\System\qAePxZM.exe
  C:\Windows\System\qAePxZM.exe
  2⤵
  PID:14256
- C:\Windows\System\lLwMQcB.exe
  C:\Windows\System\lLwMQcB.exe
  2⤵
  PID:14272
- C:\Windows\System\iOpNpKb.exe
  C:\Windows\System\iOpNpKb.exe
  2⤵
  PID:14288
- C:\Windows\System\elejWEL.exe
  C:\Windows\System\elejWEL.exe
  2⤵
  PID:14304
- C:\Windows\System\ELggnEW.exe
  C:\Windows\System\ELggnEW.exe
  2⤵
  PID:14320
- C:\Windows\System\EkrpSsZ.exe
  C:\Windows\System\EkrpSsZ.exe
  2⤵
  PID:12624
- C:\Windows\System\gAeyxvl.exe
  C:\Windows\System\gAeyxvl.exe
  2⤵
  PID:12696
- C:\Windows\System\gOhFXMS.exe
  C:\Windows\System\gOhFXMS.exe
  2⤵
  PID:12752
- C:\Windows\System\ssrfmdO.exe
  C:\Windows\System\ssrfmdO.exe
  2⤵
  PID:12772
- C:\Windows\System\CsrmUOr.exe
  C:\Windows\System\CsrmUOr.exe
  2⤵
  PID:13252
- C:\Windows\System\DglyzGo.exe
  C:\Windows\System\DglyzGo.exe
  2⤵
  PID:12656
- C:\Windows\System\jBaYanA.exe
  C:\Windows\System\jBaYanA.exe
  2⤵
  PID:12484
- C:\Windows\System\MZeNGNg.exe
  C:\Windows\System\MZeNGNg.exe
  2⤵
  PID:13320
- C:\Windows\System\rmyfYpB.exe
  C:\Windows\System\rmyfYpB.exe
  2⤵
  PID:13344
- C:\Windows\System\rjPwLbc.exe
  C:\Windows\System\rjPwLbc.exe
  2⤵
  PID:13448
- C:\Windows\System\UhFtDzc.exe
  C:\Windows\System\UhFtDzc.exe
  2⤵
  PID:13744
- C:\Windows\System\nxNFfJM.exe
  C:\Windows\System\nxNFfJM.exe
  2⤵
  PID:13792
- C:\Windows\System\GAVuyVO.exe
  C:\Windows\System\GAVuyVO.exe
  2⤵
  PID:13820
- C:\Windows\System\GOjDTEH.exe
  C:\Windows\System\GOjDTEH.exe
  2⤵
  PID:12196
- C:\Windows\System\TfFvvvy.exe
  C:\Windows\System\TfFvvvy.exe
  2⤵
  PID:13864
- C:\Windows\System\tMORlhx.exe
  C:\Windows\System\tMORlhx.exe
  2⤵
  PID:13880
- C:\Windows\System\UlXGMVV.exe
  C:\Windows\System\UlXGMVV.exe
  2⤵
  PID:12676
- C:\Windows\System\FTmxTTa.exe
  C:\Windows\System\FTmxTTa.exe
  2⤵
  PID:13904
- C:\Windows\System\sHFKyRL.exe
  C:\Windows\System\sHFKyRL.exe
  2⤵
  PID:14036
- C:\Windows\System\ugYrFYL.exe
  C:\Windows\System\ugYrFYL.exe
  2⤵
  PID:13368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:3724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ARdjOZS.exe

Filesize
1.6MB

MD5
814f59cc60370ad8e1a92dc7ccf6fc07

SHA1
bf6f040b3fead76d98b1ecc29f9b2267e7a51b62

SHA256
b35d1ea7afccb32a81c4f0893affd7d8467b5f1ebf289a2e6b9f69209efb6ff4

SHA512
81e2a4b0fcb61c6bfdc5eecc6897337849259a38003034a25fadcecceca5cf60ee65d817fc76e7b6fefd49fc3f9c93b6eaadcab7d64db3523e2ab19d955f92bc

Download Submit
C:\Windows\System\BPZhJvQ.exe

Filesize
1.6MB

MD5
b27d6a3b513caacfbb9b4fa1da7cf786

SHA1
3fac93624c403b514960bbbb2d0c5a653635efc5

SHA256
2f611df084786b73e22543d059ac97205b5644acc23cf574b313742b60b60e76

SHA512
c478a4a0d6cc08c8e4eb735790ddfe4dfb424be7c19a844f28a404f09dff0af6a930a35e53426c52ed3e84c4a33402f30073fe2c9d762bc5375660ba5f39e17d

Download Submit
C:\Windows\System\EQdQnfr.exe

Filesize
1.6MB

MD5
fc9ee6634c654cd78903038c521c8870

SHA1
080ac64b0082fd4a0f1e3765ecf143e635a80861

SHA256
5633d3f5e24bcc95fb42b449fc07c5f109ff84df0d8acf63c2097e0ab0818ee0

SHA512
7771409046a48f4b79ccad5437acfd1f2585bbd3918d1c86109df6bbf48fca9e7726f90eed4e4cb4f4a31d64e161f350dc26bf3a295561868f69a369bdc08486

Download Submit
C:\Windows\System\FWcTfwe.exe

Filesize
1.6MB

MD5
f3c27ccd43672101f5acc4423f3e4a95

SHA1
db3e444f8ec4872e11b7084b5826a00513d66ffa

SHA256
c84a92850c905cef70f038082c69bc5d353fb20b7db18f0f7044ea14d80dfe65

SHA512
b5fb27477294ca3d5af4583eb47e928a62f5bf5d69e377ac8f869eadfcd1e561c1747a3eb3813183b927751ec295a3cf4be697fb587d4cd94c5bb97dcf23916a

Download Submit
C:\Windows\System\GOIJtwE.exe

Filesize
1.6MB

MD5
dedcbe78f579a74e04e25e498309e402

SHA1
e42749a2e4231c94c0d1b3936b8ff3564cd8caa4

SHA256
09ca2e1c5b0cb1b6e3b3b632aaa2a7e31dbef1188de2833996c0678535f69ba8

SHA512
090aea94d91895b306ea2e0b908f69aca1dd8e378db40ef18d1dfa272d8b3bd653a07af3f2dc3f91324e300c7c34a0dfdd53813d30d4c81a8924f4d2eb28e0e4

Download Submit
C:\Windows\System\GiKxLHH.exe

Filesize
1.6MB

MD5
842d6622caa9e5cb05c3ad7957253899

SHA1
cf3f114dbf29bebf9a6f053224c711732027d63a

SHA256
19a5dfd3260c78b195753fce9e8020aad3acbe8d0627a6ede3da167d3d046a91

SHA512
f14f365d1ab26f4d55fe3348109e80e0dc216f3c2fcae091c0d20a734675d6a9ab53d86cdd36faafed3bd041d67fdb973001777942f89fe2977038660de8358d

Download Submit
C:\Windows\System\JcCHCXg.exe

Filesize
1.6MB

MD5
18b071ca4c45061d7d935371cb940f18

SHA1
99b1d172b0738039b7bdbaf5721987cc0c16a76a

SHA256
a810beb5dd72cac5271e19b784e27349a7bbc348fd70f74c9a291c0bcb86d843

SHA512
1751c7797568e2504e61b07ba6f4898a524aaf90dd80887d52d79c2c8ab68e4ac9074f5091ef576cd9a84462bd87b4b12a78f0f136866ad55d47cfeeca0c7ad4

Download Submit
C:\Windows\System\JoTFydd.exe

Filesize
1.6MB

MD5
b3ebae560452096ce18087cc982ed2f8

SHA1
db32654a7f38d41f23b838c7fda7728344a43bd9

SHA256
63dad284d1b468a03d672a8868ef6f626424b2c435e00e169c64070c0b911df7

SHA512
7cf24b80b184fd7b31fac140750f0c9223c553273cbe9b82f1ca1d204e8daaf60127d4cb8af1d651b87472c878ee6af926cbd3142e69e0418486bb55dc5f5f89

Download Submit
C:\Windows\System\LyIFwlQ.exe

Filesize
1.6MB

MD5
3f58674d09e12d043c4a910a216be7b7

SHA1
d0345129500fb1540c89c6c119774edd9944e16f

SHA256
6614721549841cdd344db2a39401a01dd63675cc4e6b946b031b95b46ba1b90f

SHA512
48e3fa1f58bef13250df072dea1bbe9feb9d49e17f4ac73ccd2818d13c4e0d36b75eeec8680b0851913c9c22d5ffd3ab0fe10ea1fd91554485fe034b9e019277

Download Submit
C:\Windows\System\NGDOIui.exe

Filesize
1.6MB

MD5
aeb13a4c2a3ca5223a38af7a3dc1192d

SHA1
0c6ce7705d5462c0913b956e0eb35a3c4f40a309

SHA256
ab5a89f28698dae93f7b4dee8ca8257888b94c45cac0b441888c4a1c133aee12

SHA512
a08ed8ead5f040e29ca70f00fe234e5e8f8636dcd649ec2ca6cb62612c36fa2ffc8097a44ecb181809ab05411d22ec7f93cd88a96101f585154f5b1d66cc776b

Download Submit
C:\Windows\System\OKEhlsL.exe

Filesize
1.6MB

MD5
90a70939ed830072bf4a434f685def4b

SHA1
954995f161d4112216a996c10f02481cac5fb85e

SHA256
090834962589937622365c46e35e45bb67e8b2850460205c6b30933eec3eed30

SHA512
57389b3c96429c6e410cda9ae2dcd0ec7896fb8962dfa10ca2b2e50cf8ea993fc2c671280e2b2a334b807a924836b8232f9e74bbb8253128c6b42afedc6271e1

Download Submit
C:\Windows\System\OpxedMB.exe

Filesize
1.6MB

MD5
44ba94c087e6b5c9b05aa62c0e79171a

SHA1
ffafb23e526e4b170fbdaf193547185956791ff4

SHA256
c162429d62c10f4709e3592996a8e9da57605c6bdd01b1a3490598cbae7d0728

SHA512
530b3239567c617f76b60c497f6bc50c89e2984967d71f380957f875fa118309ddad2d5b85bf49874d4adaf9d560d73090d80756dfd0ac7c23d393df44e26808

Download Submit
C:\Windows\System\TDuCTvM.exe

Filesize
1.6MB

MD5
28e05ca08c97ab5afff2aba1208dd7e8

SHA1
74fc0e194c730c5e15ddf7493163c8784095679a

SHA256
d2b611d2f8ceffc8ee5f550e26477aaaa805dff43e593b95f2d8dadf3d40ec1c

SHA512
eb18b11cf96a38dc50a4c31be680338e168749cad2e41d17ce4a2d26fc0fe24f0ed64058c605b04ed2c99bb8e84c106e90870b2b34c7da25d55fb2ea35c4dc84

Download Submit
C:\Windows\System\XyLPHtO.exe

Filesize
1.6MB

MD5
92b8620c408c8d2a9ef65ae0441b60c8

SHA1
b0b0ff92e6f133c2c52d601119488254247c7192

SHA256
2794c1185845d2ef8fd730dea6f0a710722cd1bf076c4929e26bad82bf4315d5

SHA512
f0e40cfff81227d564058ae0fd438ac5ee51aacf6b4a18f793b239ea35eba7450bdc6e1e90d5343b659f5f16850e751221abc9ce4b0e6a3fec7a73f9c9479288

Download Submit
C:\Windows\System\aPxLnCB.exe

Filesize
1.6MB

MD5
3815c706f41e12be9168a6c09a959ec7

SHA1
c36b63ac34bd942f7177aadb3e3c33992e95338c

SHA256
7fa198b631605513f10e228517a67a995b8a368a5657ead3aa5be3dcf18ae93e

SHA512
f286bbf4317908b0d8a6a74515ab341b66b0fd1181ffda49475241c5de21ecb3175baebfd97a1ef732bc237ae260d43fd30ff2a305c42e7dec4fdf3fdc8aec94

Download Submit
C:\Windows\System\fNnehyj.exe

Filesize
1.6MB

MD5
27fd3da1e9e39ffb8a8fecc28b1b3117

SHA1
cdb9df9a2054a1b70141d78ca8701c91443a4b15

SHA256
ab13e6e37554d5ae05534ba244e1f048c7cef28dc3f87cf81e4306eb377ea0b0

SHA512
c878cb3e6f13287bc04904054467fdb3af414a32ac0881934099f69204f166301e6dbd289384ce7399cc54be4e3a5200c0d78dfe9c6bc05f134d47e38c3a16a2

Download Submit
C:\Windows\System\hJcxdbg.exe

Filesize
1.6MB

MD5
707a1250e83a5dbf88a3a81cf91334f1

SHA1
d927d6cf8e45535b9261692181f25f83a6c16880

SHA256
ac652e7e2256d0d17a28f412b3dc4513874560e04843789c19ac53a369c3dda0

SHA512
e26358cf6ca952daf9603ef17ed3fe6cae2008d213e4673b385c7361fb547d67a2e04923fb34a74670acb282020c67d774d3ff8ffda14787f849310b8b5528ba

Download Submit
C:\Windows\System\iLJYcDy.exe

Filesize
1.6MB

MD5
834d3fb7912bb2f968ec46e6fd13a760

SHA1
b12b7ae18b746472a388bca3753efb8fb34c5c10

SHA256
a1fcfb1bfcfcf5e2ec43263d63eb3e899546dd48a382e2db1bc644ddba7bcd5e

SHA512
d75a7182febf54c7ff0264ecb3a196fa738234d6742c85efd9998a525ec210d5b88924d5e4e2eef61547997ec3252e8a11de33a24ba304ac68dc05b9a483d08d

Download Submit
C:\Windows\System\itQCTxn.exe

Filesize
1.6MB

MD5
69a249dc1467e0374b1bcc98c233e82f

SHA1
8656abb5a73ad5ccceb98c8055905bcfc3a63f9e

SHA256
dcedae9c6eaafdbf23fcdfcf17d7f7c75ebd7e0797d3c8426d5836613e4cc535

SHA512
b3bab11286278f4a031cfd0379cf00334f99b2950917162dcd62678ce12c0551b9afabde3af86bdeb48a91abe21b5d0a68084fb51b45549794a4b2ffbc419272

Download Submit
C:\Windows\System\jNgGZMO.exe

Filesize
1.6MB

MD5
01117265a92e6d7e57a847346359d7c0

SHA1
831ebc3b01406b211e6cb1154864fb1ac314b501

SHA256
0db7e606fdc824ec12d3ab5971442352d6f9aa8b914bc50542e53bf173a650b7

SHA512
d8f44003ff6b17e19b84e8709883fde4c639169e0cbd15eeeb32f217524730dd22a3dbbdb47137cb6720b647c5a98bfd0fe63495384e8dcfa7337d882ab9de2a

Download Submit
C:\Windows\System\joEEuVv.exe

Filesize
1.6MB

MD5
69e05c745486c42d858dbd3fa36ecab0

SHA1
ff2e0e5c74d33e053469fd05f03b459863961528

SHA256
ff08e0e7e3adf5e885c7e59b51b616a3632d1b76fb2179f69f5d8c2f7f31b445

SHA512
5aff8d47b8aa7a36e2e14fea9e797166290a2802f99af54a68ff9553975b0db51d5d6c6b2487392549576face5da90e1a81064a0bb3d9b2bf2e9122eddc89506

Download Submit
C:\Windows\System\onfImtq.exe

Filesize
1.6MB

MD5
d244b29cb92aab6e43c9eff2d983ee7c

SHA1
14ac6add8554e2efc1000eefbfd6dba6ac808146

SHA256
8bc2e0f4902d7737627631024098967ee6d23b4aedb7b82cb70982505394b0c5

SHA512
311f702fc6e51b8299daba951ecfaffd1db014cf1b5c88219a4e201a80987640c066b802b9492752f1a6e6937f871127e3d06e018dd09626403171fb40cd7b90

Download Submit
C:\Windows\System\sXHIJSW.exe

Filesize
1.6MB

MD5
6b670b6ac5d425e7a37dac6128bf1aa8

SHA1
f1330bf6e898d1e2b1c1592ee80c47efabaca12a

SHA256
420846f91afddf25b3a0752f816679e71bd73a9316e28941b513fabcd53c5a88

SHA512
ac1f6fdf7115a34befe5e0aefdc28c6006da0ffb83f15fda0d191a14f0d83bb88d0cb69c1b177b80072b5c53f35a01419ad16cedfaf01e019a5733c4e9c7872e

Download Submit
C:\Windows\System\sbqoLQY.exe

Filesize
1.6MB

MD5
11af3094e7ca46988686071c31fa1b64

SHA1
3823f1af75dd9ef9926e56c573eaae5101e78fa7

SHA256
6a4a5fd796a80f7193e013542f0a9b935379197e1d7902a042ac1c75eb73e61f

SHA512
48d3563400b82635dfda308e1a7f9e38a60c39b65058ba0d413612b8ad35f20910e324f0d83cc599a4be6b75d37c04965ec2dd6a0e46f90b9b405e278f519880

Download Submit
C:\Windows\System\swDsdtK.exe

Filesize
1.6MB

MD5
b724fcddf79907242a218da4ace77048

SHA1
219899a056143c47ff0057c5a453318eff8a6a3a

SHA256
acbf562211a3f6ce417df63e0f47a0c2916e3e83dd04023ec2a49f637564fb5b

SHA512
f1e2b023890e722f4b394ed1534d85ffbb0be2006ab1eb9d634d071067c7d37683ac5f9a1f2d127fa2241588cb9ef021dfc387730944e2aeb7f48320290c6a08

Download Submit
C:\Windows\System\tdAUmPo.exe

Filesize
1.6MB

MD5
726a70d6364331fa5f18a5679d17152c

SHA1
b8869c344b15cd51abd9b77375fbc455270dc926

SHA256
567db9414d70addf624e4db67493e3dc143a67ec95291a90b35c19a9546c9f22

SHA512
0327c054d239085fa371e77ff1d2a722059d493244edf23241c0d6946765c975ca58bf4aa0cb0ac93d338fe6f590f51ad8476124a8e79f04523bf520c2842a55

Download Submit
C:\Windows\System\twSjnlQ.exe

Filesize
1.6MB

MD5
c913c9f3f711b7f5e2ea080485f99bb9

SHA1
12b120c2ae53a8f570730e64a4a67bd62d0d2ee9

SHA256
16d71f246934141df8cd8df7777d7539dafeae0ee7f658d65135717072361ede

SHA512
1f863a6ff88c3e6bdb77c29c4d3c4bac2c2a918b8f36545ebfcb2f8132d2ebfc6e79194edad87edff2b55a8fb55450a5987ab82e4992fbd43e65bc9165fec657

Download Submit
C:\Windows\System\tyUDVub.exe

Filesize
1.6MB

MD5
faabcbb5d78e2a0380ed41206249caa7

SHA1
de8f574cbc3d9fb4ff0e82965455b640c22fb89a

SHA256
5c5d44e04e7d01cd47516e8cd474c80985261ac7f7e23c213fd88f4886a0da0b

SHA512
905b5601557051f69ffdaa4727ba01136420547fe840735e92d396bb04954da574a2b24ee31d9293e1bf2830234647d4fb5b4c60d96bce6615f6851496c739ed

Download Submit
C:\Windows\System\vmctFot.exe

Filesize
1.6MB

MD5
533b748709ae1ab56b38e7e05883a5c1

SHA1
34689c081529dcf937a061b7feea44046eb86bf9

SHA256
af59789eed6e9c3cdef7a567c2d836b9df40bfb1280c611de66b137323bfe4a4

SHA512
6d54b9520dedb78cc3890b5d76bd5eb51b45b333b5f98271d717bb1e3d74ec36196f2a618e08faef858f6e64d6ddbbfdd99235645297e7db77ae464585cf39d5

Download Submit
C:\Windows\System\vwungCW.exe

Filesize
1.6MB

MD5
43f5f74bd2c538fd41f8913685e3a490

SHA1
8aa2c37a9cc5110defa9d80c511837ce57917689

SHA256
90a40b5fbe638b42a56edd8a9d774f277b3a75ec982aa20a878316d2d42be8a5

SHA512
5db96fb672e9c5d07706d9a961ccf78e646dc75da942abbd6dbcd830853f6367b14c43028aea6b37fe736f6368cd29a7438cbf53638b39fc903b242191bb42cd

Download Submit
C:\Windows\System\yZIOWJW.exe

Filesize
1.6MB

MD5
48bf023fa61c978dd661f61fe017c989

SHA1
21cf3dc4c7cd480e30b8510d264b3618b1fd5b1d

SHA256
97fedd41dc39cec56fd473dd6e899c0f3cc031908d4933c9accb20e1e9894ec0

SHA512
ed931bdec1c33264e66c754126ced24448fde954b42ef2a533865f84c8b49ec4efcea3d3f66ebb4cfeb1694255ae5d7354727a8829a570d565029b8591d49002

Download Submit
C:\Windows\System\zUYvkdY.exe

Filesize
1.6MB

MD5
156ce52aa45307602cea82af79f24e85

SHA1
948ed0fe2ff894cf8439d24b9275a6103bfa057f

SHA256
c7e658b6a1d382b52ff5589b93a4e5c25290f86fc327766733be288e40cabb96

SHA512
323bbee8c21ffc6eac757bea9aad11070ee238b1418022023806351a4c7c0141efbf88b131b9c2aa3162924fad2b90b5236d81307be76d3ddabb277c89fc14c9

Download Submit
memory/224-2148-0x00007FF710A50000-0x00007FF710DA1000-memory.dmp

Filesize
3.3MB

Download
memory/224-73-0x00007FF710A50000-0x00007FF710DA1000-memory.dmp

Filesize
3.3MB

Download
memory/788-2152-0x00007FF7285E0000-0x00007FF728931000-memory.dmp

Filesize
3.3MB

Download
memory/788-43-0x00007FF7285E0000-0x00007FF728931000-memory.dmp

Filesize
3.3MB

Download
memory/1520-100-0x00007FF6A4D50000-0x00007FF6A50A1000-memory.dmp

Filesize
3.3MB

Download
memory/1520-2162-0x00007FF6A4D50000-0x00007FF6A50A1000-memory.dmp

Filesize
3.3MB

Download
memory/1836-49-0x00007FF6253E0000-0x00007FF625731000-memory.dmp

Filesize
3.3MB

Download
memory/1836-2151-0x00007FF6253E0000-0x00007FF625731000-memory.dmp

Filesize
3.3MB

Download
memory/2128-2142-0x00007FF737C40000-0x00007FF737F91000-memory.dmp

Filesize
3.3MB

Download
memory/2128-21-0x00007FF737C40000-0x00007FF737F91000-memory.dmp

Filesize
3.3MB

Download
memory/2340-2145-0x00007FF7B4C30000-0x00007FF7B4F81000-memory.dmp

Filesize
3.3MB

Download
memory/2340-40-0x00007FF7B4C30000-0x00007FF7B4F81000-memory.dmp

Filesize
3.3MB

Download
memory/2348-2184-0x00007FF6084C0000-0x00007FF608811000-memory.dmp

Filesize
3.3MB

Download
memory/2348-276-0x00007FF6084C0000-0x00007FF608811000-memory.dmp

Filesize
3.3MB

Download
memory/2584-2165-0x00007FF6C6100000-0x00007FF6C6451000-memory.dmp

Filesize
3.3MB

Download
memory/2584-160-0x00007FF6C6100000-0x00007FF6C6451000-memory.dmp

Filesize
3.3MB

Download
memory/2592-2182-0x00007FF6F9E50000-0x00007FF6FA1A1000-memory.dmp

Filesize
3.3MB

Download
memory/2592-135-0x00007FF6F9E50000-0x00007FF6FA1A1000-memory.dmp

Filesize
3.3MB

Download
memory/2600-125-0x00007FF7EB5F0000-0x00007FF7EB941000-memory.dmp

Filesize
3.3MB

Download
memory/2600-2195-0x00007FF7EB5F0000-0x00007FF7EB941000-memory.dmp

Filesize
3.3MB

Download
memory/2680-2156-0x00007FF79F9D0000-0x00007FF79FD21000-memory.dmp

Filesize
3.3MB

Download
memory/2680-145-0x00007FF79F9D0000-0x00007FF79FD21000-memory.dmp

Filesize
3.3MB

Download
memory/2768-79-0x00007FF6D68B0000-0x00007FF6D6C01000-memory.dmp

Filesize
3.3MB

Download
memory/2768-2161-0x00007FF6D68B0000-0x00007FF6D6C01000-memory.dmp

Filesize
3.3MB

Download
memory/2864-2207-0x00007FF6DD480000-0x00007FF6DD7D1000-memory.dmp

Filesize
3.3MB

Download
memory/2864-311-0x00007FF6DD480000-0x00007FF6DD7D1000-memory.dmp

Filesize
3.3MB

Download
memory/2984-2170-0x00007FF778CF0000-0x00007FF779041000-memory.dmp

Filesize
3.3MB

Download
memory/2984-114-0x00007FF778CF0000-0x00007FF779041000-memory.dmp

Filesize
3.3MB

Download
memory/3268-2131-0x00007FF653DB0000-0x00007FF654101000-memory.dmp

Filesize
3.3MB

Download
memory/3268-17-0x00007FF653DB0000-0x00007FF654101000-memory.dmp

Filesize
3.3MB

Download
memory/3268-2138-0x00007FF653DB0000-0x00007FF654101000-memory.dmp

Filesize
3.3MB

Download
memory/3304-148-0x00007FF6DA6A0000-0x00007FF6DA9F1000-memory.dmp

Filesize
3.3MB

Download
memory/3304-1-0x00000282A33E0000-0x00000282A33F0000-memory.dmp

Filesize
64KB

Download
memory/3304-0-0x00007FF6DA6A0000-0x00007FF6DA9F1000-memory.dmp

Filesize
3.3MB

Download
memory/3592-117-0x00007FF6229C0000-0x00007FF622D11000-memory.dmp

Filesize
3.3MB

Download
memory/3592-2168-0x00007FF6229C0000-0x00007FF622D11000-memory.dmp

Filesize
3.3MB

Download
memory/3604-2181-0x00007FF6EF360000-0x00007FF6EF6B1000-memory.dmp

Filesize
3.3MB

Download
memory/3604-168-0x00007FF6EF360000-0x00007FF6EF6B1000-memory.dmp

Filesize
3.3MB

Download
memory/3608-209-0x00007FF7FAE30000-0x00007FF7FB181000-memory.dmp

Filesize
3.3MB

Download
memory/3608-2177-0x00007FF7FAE30000-0x00007FF7FB181000-memory.dmp

Filesize
3.3MB

Download
memory/3616-35-0x00007FF7E3A80000-0x00007FF7E3DD1000-memory.dmp

Filesize
3.3MB

Download
memory/3616-2146-0x00007FF7E3A80000-0x00007FF7E3DD1000-memory.dmp

Filesize
3.3MB

Download
memory/3752-130-0x00007FF7128A0000-0x00007FF712BF1000-memory.dmp

Filesize
3.3MB

Download
memory/3752-2175-0x00007FF7128A0000-0x00007FF712BF1000-memory.dmp

Filesize
3.3MB

Download
memory/4184-2154-0x00007FF6B4FB0000-0x00007FF6B5301000-memory.dmp

Filesize
3.3MB

Download
memory/4184-140-0x00007FF6B4FB0000-0x00007FF6B5301000-memory.dmp

Filesize
3.3MB

Download
memory/4404-238-0x00007FF753AF0000-0x00007FF753E41000-memory.dmp

Filesize
3.3MB

Download
memory/4404-2186-0x00007FF753AF0000-0x00007FF753E41000-memory.dmp

Filesize
3.3MB

Download
memory/4464-2191-0x00007FF7604C0000-0x00007FF760811000-memory.dmp

Filesize
3.3MB

Download
memory/4464-243-0x00007FF7604C0000-0x00007FF760811000-memory.dmp

Filesize
3.3MB

Download
memory/4488-239-0x00007FF690480000-0x00007FF6907D1000-memory.dmp

Filesize
3.3MB

Download
memory/4488-2189-0x00007FF690480000-0x00007FF6907D1000-memory.dmp

Filesize
3.3MB

Download
memory/4548-2166-0x00007FF6B1440000-0x00007FF6B1791000-memory.dmp

Filesize
3.3MB

Download
memory/4548-103-0x00007FF6B1440000-0x00007FF6B1791000-memory.dmp

Filesize
3.3MB

Download
memory/4556-86-0x00007FF77C860000-0x00007FF77CBB1000-memory.dmp

Filesize
3.3MB

Download
memory/4556-2158-0x00007FF77C860000-0x00007FF77CBB1000-memory.dmp

Filesize
3.3MB

Download
memory/4644-31-0x00007FF725B10000-0x00007FF725E61000-memory.dmp

Filesize
3.3MB

Download
memory/4644-2141-0x00007FF725B10000-0x00007FF725E61000-memory.dmp

Filesize
3.3MB

Download
memory/4660-2179-0x00007FF6AFD00000-0x00007FF6B0051000-memory.dmp

Filesize
3.3MB

Download
memory/4660-182-0x00007FF6AFD00000-0x00007FF6B0051000-memory.dmp

Filesize
3.3MB

Download
memory/4944-2136-0x00007FF6DC450000-0x00007FF6DC7A1000-memory.dmp

Filesize
3.3MB

Download
memory/4944-263-0x00007FF6DC450000-0x00007FF6DC7A1000-memory.dmp

Filesize
3.3MB

Download
memory/4944-11-0x00007FF6DC450000-0x00007FF6DC7A1000-memory.dmp

Filesize
3.3MB

Download